QL code and tests for C#/C++/JavaScript.

javascript/ql/test/library-tests/TaintTracking/BasicTaintTracking.expected

@@ -0,0 +1,2 @@
+| tst.js:2:13:2:20 | source() | tst.js:4:10:4:10 | x |
+| tst.js:2:13:2:20 | source() | tst.js:5:10:5:22 | "/" + x + "!" |

javascript/ql/test/library-tests/TaintTracking/BasicTaintTracking.ql

@@ -0,0 +1,23 @@
+import javascript
+
+DataFlow::CallNode getACall(string name) {
+  result.getCalleeName() = name
+}
+
+class BasicConfig extends TaintTracking::Configuration {
+  BasicConfig() { this = "BasicConfig" }
+
+  override
+  predicate isSource(DataFlow::Node node) {
+    node = getACall("source")
+  }
+
+  override
+  predicate isSink(DataFlow::Node node) {
+    node = getACall("sink").getAnArgument()
+  }
+}
+
+from BasicConfig cfg, DataFlow::Node src, DataFlow::Node sink
+where cfg.hasFlow(src, sink)
+select src, sink

javascript/ql/test/library-tests/TaintTracking/tst.js

@@ -0,0 +1,13 @@
+function test() {
+    let x = source();
+
+    sink(x); // NOT OK
+    sink("/" + x + "!"); // NOT OK
+
+    sink(x == null); // OK
+    sink(x == undefined); // OK
+    sink(x == 1); // OK
+    sink(x === 1); // OK
+    sink(undefined == x); // OK
+    sink(x === x); // OK
+}