General issue: CWE-116 not reported for unescaped XML output in JavaScript/TypeScript

**Description**
CodeQL security scan did not recognise the CWE-116 (Improper Encoding or Escaping of Output) in a Sitemap.xml.ts file when unescaped values are embedded into XML output.

**Example**
A sitemap is generated dynamically by interpolating application-derived values
into XML elements:

```ts
function generateSitemap(entries: string[]) {
return `

${entries.map(path => `

${BASE_URL}/${path}

`).join("")}
`;
}
```
Values here are embedded directly into XML elements without escaping.

**Question**
I would like to understand whether this pattern is currently not covered by the JavaScript/TypeScript analysis, or whether the scanning logic intentionally determines that this does not constitute a CWE-116 weakness when generating XML output such as a sitemap.

Start by reproducing the reported CodeQL result against the Sitemap.xml.ts example and then inspect the JavaScript/TypeScript analysis coverage for XML output. Done means determining whether unescaped XML interpolation is intentionally excluded or should be reported as CWE-116, with the resulting behavior or rationale clearly documented.

Scritto dal modello di indicizzazione a partire dal testo della issue.