I notice in our code an instance of
# sobelow_skip ["XSS.Raw"]
def a_function(arg) do
that_does_not_call_raw()
end
I believe sobelow should raise an error on these. They do not reflect the code / current intention. Although unlikely, they could allow someone to add raw without it being super apparent in the diff of the resulting PR.
Thanks for sobelow