Merge branch 'main' into js/shared-dataflow-merge-main

javascript/ql/test/library-tests/TaintTracking/array-mutation.js

@@ -38,4 +38,40 @@ function test(x, y) {
   let j = [];
   j[j.length] = source();
   sink(j); // NOT OK
+
+  let k = [];
+  let kSpliced = k.toSpliced(x, y, source());
+  sink(k); // OK
+  sink(kSpliced); // NOT OK
+
+  let l = [];
+  l = l.toSpliced(x, y, source());
+  sink(l); // NOT OK
+
+  let m = [];
+  m = m.toSpliced(q, source(), y);
+  sink(m); // OK
+
+  let n = [];
+  n = n.toSpliced(source(), x);
+  sink(n); // OK
+
+  let o = [];
+  o = o.toSpliced(x, source());
+  sink(o); // OK
+
+  let p = [];
+  p = p.toSpliced(source(), x, y);
+  sink(p); // OK
+
+  let q = [];
+  q.splice(x, y, ...source());
+  sink(q); // NOT OK
+
+  let r = [];
+  let rSpliced = r.toSpliced(x, y, ...source());
+  sink(rSpliced); // NOT OK
+  sink(r); // OK
+  r = r.toSpliced(x, y, ...source());
+  sink(r); // NOT OK
 }

javascript/ql/test/library-tests/TaintTracking/tst.js

@@ -57,4 +57,19 @@ function test() {
     }
 
     tagged`foo ${"safe"} bar ${x} baz`;
+
+    sink(x.reverse()); // NOT OK
+    sink(x.toSpliced()); // NOT OK
+
+    sink(x.toSorted()) // NOT OK
+    const xSorted = x.toSorted();
+    sink(xSorted) // NOT OK
+
+    sink(x.toReversed()) // NOT OK
+    const xReversed = x.toReversed();
+    sink(xReversed) // NOT OK
+
+    sink(x.with()) // NOT OK
+    const xWith = x.with();
+    sink(xWith) // NOT OK
 }