Description of the issue

File: [javascript/ql/src/Security/CWE-116/IncompleteSanitization.ql]
Description: A string transformer that does not replace or escape all occurrences of a meta-character may be ineffective.

Usage: "WorkflowId": workflowId.replace("}", "")

Issue: This replaces only the first occurrence of "}", but not all the occurrences.

workflowId is a system generated GUID and contains single occurrence of "{" & "}"

Sample Input & Output:
Input: {9ca385f1-88d7-ec11-a7b5-002248283310}
Output: 9ca385f1-88d7-ec11-a7b5-002248283310

In our scenario, we are using replace() function to replace only first occurrence of a character in a system generated GUID (not user input). As per the exception, it is suggested to use '/g' or regular expression to fix all the occurrences of any replacement character. But replacement of all the occurrences is not valid in our scenario.

Is this a valid rule that should be applied to any scenario (like ours)? or applicable only for few scenarios like for sanitizing user inputs or for rendering the data etc.