rust: Add config-derived host barrier for XSS

rust/ql/lib/change-notes/2026-06-16-xss-exclude-environment-sources.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* The cross-site scripting (XSS) query no longer treats environment variables (the `environment` threat model, e.g. `std::env::var`) as a taint source. These values are trusted deployment configuration set at startup rather than per-request attacker-controlled input, so excluding them removes a class of false positives.

rust/ql/lib/codeql/rust/security/XssExtensions.qll

@@ -35,8 +35,15 @@ module Xss {
 
   /**
    * An active threat-model source, considered as a flow source.
+   *
+   * Environment variables are excluded: they hold trusted deployment
+   * configuration (for example the service's own hostname or public base URL,
+   * set from an environment variable at startup) rather than per-request,
+   * attacker-controlled input, so they are not a meaningful source for XSS.
    */
-  private class ActiveThreatModelSourceAsSource extends Source, ActiveThreatModelSource { }
+  private class ActiveThreatModelSourceAsSource extends Source, ActiveThreatModelSource {
+    ActiveThreatModelSourceAsSource() { not this.getThreatModel() = "environment" }
+  }
 
   /**
    * A sink for XSS from model data.