Merge pull request #17993 from Napalys/napalys/ES2023-array-protype-with

JS: Added support for Array.prototype.with() ES2023 feature

Author: Napalys

javascript/ql/lib/change-notes/2024-11-18-ES2023-array-protype-with.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+Added taint-steps for `Array.prototype.with`.

javascript/ql/lib/semmle/javascript/Arrays.qll

@@ -477,7 +477,7 @@ private module ArrayLibraries {
   private class ImmutableArrayTransformStep extends TaintTracking::SharedTaintStep {
     override predicate heapStep(DataFlow::Node pred, DataFlow::Node succ) {
       exists(DataFlow::MethodCallNode call |
-        call.getMethodName() in ["toSorted", "toReversed"] and
+        call.getMethodName() in ["toSorted", "toReversed", "with"] and
         pred = call.getReceiver() and
         succ = call
       )

javascript/ql/test/library-tests/TaintTracking/BasicTaintTracking.expected

@@ -244,6 +244,8 @@ typeInferenceMismatch
 | tst.js:2:13:2:20 | source() | tst.js:66:10:66:16 | xSorted |
 | tst.js:2:13:2:20 | source() | tst.js:68:10:68:23 | x.toReversed() |
 | tst.js:2:13:2:20 | source() | tst.js:70:10:70:18 | xReversed |
+| tst.js:2:13:2:20 | source() | tst.js:72:10:72:17 | x.with() |
+| tst.js:2:13:2:20 | source() | tst.js:74:10:74:14 | xWith |
 | xml.js:5:18:5:25 | source() | xml.js:8:14:8:17 | text |
 | xml.js:12:17:12:24 | source() | xml.js:13:14:13:19 | result |
 | xml.js:23:18:23:25 | source() | xml.js:20:14:20:17 | attr |

javascript/ql/test/library-tests/TaintTracking/tst.js

@@ -68,4 +68,8 @@ function test() {
     sink(x.toReversed()) // NOT OK
     const xReversed = x.toReversed();
     sink(xReversed) // NOT OK
+
+    sink(x.with()) // NOT OK
+    const xWith = x.with();
+    sink(xWith) // NOT OK
 }