Added test case for Array.prototype.reverse, which is currently not flagged as a potential sink.

Napalys · Napalys · commit 1c298f0231e0 · 2024-11-11T08:32:02.000+01:00
diff --git a/javascript/ql/test/library-tests/TaintTracking/tst.js b/javascript/ql/test/library-tests/TaintTracking/tst.js
@@ -57,4 +57,6 @@ function test() {
     }
 
     tagged`foo ${"safe"} bar ${x} baz`;
+
+    sink(x.reverse()); // NOT OK -- Should be caught but isn't
 }

Original file line number	Diff line number	Diff line change
`@@ -57,4 +57,6 @@ function test() {`
`57`	`57`	`}`
`58`	`58`
`59`	`59`	tagged`foo ${"safe"} bar ${x} baz`;
	`60`	`+`
	`61`	`+ sink(x.reverse()); // NOT OK -- Should be caught but isn't`
`60`	`62`	`}`