Merge pull request #20397 from asgerf/js/build-artifact-leak-fp

JS: Fix FP in js/build-artifact-leak when keys come from an array of constants

javascript/ql/lib/semmle/javascript/security/dataflow/CleartextLoggingCustomizations.qll

@@ -247,10 +247,24 @@ module CleartextLogging {
       reduceCall.getABoundCallbackParameter(0, 1) = name
     |
       reduceCall.getReceiver+().(DataFlow::MethodCallNode).getMethodName() = "filter"
+      or
+      isArrayOfConstants(reduceCall.getReceiver+())
     )
     or
     exists(StringOps::RegExpTest test | test.getStringOperand().getALocalSource() = name)
     or
     exists(MembershipCandidate test | test.getAMemberNode().getALocalSource() = name)
   }
+
+  private predicate isArrayOfConstants(DataFlow::ArrayCreationNode array) {
+    forex(DataFlow::Node node |
+      node =
+        [
+          array.getAnElement(), array.getAPropertyWrite().getRhs(),
+          array.getAMethodCall("push").getArgument(0)
+        ]
+    |
+      exists(node.getStringValue())
+    )
+  }
 }