Added test case for Array.prototype.toReversed, which is currently not flagged as a taint sink.

Author: Napalys

javascript/ql/lib/semmle/javascript/Arrays.qll

@@ -466,7 +466,7 @@ private module ArrayLibraries {
   private class ImmutableArrayTransformStep extends TaintTracking::SharedTaintStep {
     override predicate heapStep(DataFlow::Node pred, DataFlow::Node succ) {
       exists(DataFlow::MethodCallNode call |
-        call.getMethodName() = "toSorted" and
+        call.getMethodName() in ["toSorted", "toReversed"] and
         pred = call.getReceiver() and
         succ = call
       )

javascript/ql/test/library-tests/TaintTracking/BasicTaintTracking.expected

@@ -236,6 +236,8 @@ typeInferenceMismatch
 | tst.js:2:13:2:20 | source() | tst.js:61:10:61:20 | x.reverse() |
 | tst.js:2:13:2:20 | source() | tst.js:63:10:63:21 | x.toSorted() |
 | tst.js:2:13:2:20 | source() | tst.js:65:10:65:16 | xSorted |
+| tst.js:2:13:2:20 | source() | tst.js:67:10:67:23 | x.toReversed() |
+| tst.js:2:13:2:20 | source() | tst.js:69:10:69:18 | xReversed |
 | xml.js:5:18:5:25 | source() | xml.js:8:14:8:17 | text |
 | xml.js:12:17:12:24 | source() | xml.js:13:14:13:19 | result |
 | xml.js:23:18:23:25 | source() | xml.js:20:14:20:17 | attr |

javascript/ql/test/query-tests/NodeJS/DubiousImport/externs.js

@@ -333,6 +333,15 @@ Array.prototype.push = function(var_args) {};
  */
 Array.prototype.reverse = function() {};
 
+/**
+ * Returns a new array with the elements in reversed order.
+ *
+ * @this {{length: number}}
+ * @template T
+ * @see https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Array/toReversed
+ */
+Array.prototype.toReversed = function() {};
+
 /**
  * Removes the first element from an array and returns that element. This
  * method changes the length of the array.