JavaScript: Request forgery taint blocked by base argument of "new URL(url, base)" #23066

Description of the issue

CodeQL fails to detect JavaScript request forgery vulnerabilities where the taint (user input) is passed through the base argument of the new URL(url, base) constructor.

Reproduction steps

CodeQL correctly detects a server-side request forgery issue in this code:

app.get("/head", async (req, res) => {
  const via = req.headers["via"];
  const url = new URL(`https://${via}/assets/head.html`);
  const response = await fetch(url.href);
  res.send(await response.text());
});

But fails to detect the following issue:

  const via = req.headers["via"];
  const url = new URL("/assets/head.html", `https://${via}`);
  const response = await fetch(url.href);
  res.send(await response.text());

Other details
The base argument of new URL(url, base) doesn't flow taint into the URL object in every situation; for example, an absolute URL supplied in the url could cause base to be ignored. For that reason, it's unclear whether this was an intentional design to reduce false positives or an omission; I'm suspecting the later.

The code with the issue is likely here:

Note the "url.getArgument(0)" but no equivalent for the second argument.