add taint-step for Array.reduce

javascript/ql/src/semmle/javascript/Arrays.qll

@@ -40,6 +40,11 @@ module ArrayTaintTracking {
       succ = call
     )
     or
+    // `arary.reduce` with tainted value in callback
+    call.(DataFlow::MethodCallNode).getMethodName() = "reduce" and
+    pred = call.getArgument(0).(DataFlow::FunctionNode).getAReturn() and // Require the argument to be a closure to avoid spurious call/return flow
+    succ = call
+    or
     // `array.push(e)`, `array.unshift(e)`: if `e` is tainted, then so is `array`.
     exists(string name |
       name = "push" or