my compound commit

javascript/ql/lib/semmle/javascript/Arrays.qll

@@ -36,12 +36,18 @@ module ArrayTaintTracking {
       succ = call
     )
     or
-    // `array.filter(x => x)` keeps the taint
+    // `array.filter(x => x)` and `array.filter(x => !!x)` keeps the taint
     call.(DataFlow::MethodCallNode).getMethodName() = "filter" and
     pred = call.getReceiver() and
     succ = call and
-    exists(DataFlow::FunctionNode callback | callback = call.getArgument(0).getAFunctionValue() |
-      callback.getParameter(0).getALocalUse() = callback.getAReturn()
+    exists(DataFlow::FunctionNode callback, DataFlow::Node param, DataFlow::Node ret |
+      callback = call.getArgument(0).getAFunctionValue() and
+      param = callback.getParameter(0).getALocalUse() and
+      ret = callback.getAReturn()
+    |
+      param = ret
+      or
+      param = DataFlow::exprNode(ret.asExpr().(LogNotExpr).getOperand().(LogNotExpr).getOperand())
     )
     or
     // `array.reduce` with tainted value in callback

javascript/ql/test/library-tests/Arrays/arrays.js

@@ -11,11 +11,10 @@
     sink(arr[i]); // NOT OK
   }
 
-
   arr.forEach((e) => sink(e)); // NOT OK
   arr.map((e) => sink(e)); // NOT OK
 
-  [1, 2, 3].map(i => "source").forEach(e => sink(e)); // NOT OK.
+  [1, 2, 3].map((i) => "source").forEach((e) => sink(e)); // NOT OK.
 
   sink(arr.pop()); // NOT OK
 
@@ -40,13 +39,12 @@
   }
   sink(arr6.pop()); // NOT OK
 
-
   ["source"].forEach((e, i, ary) => {
     sink(ary.pop()); // NOT OK
     sink(ary); // OK - its the array itself, not an element.
   });
 
-  sink(arr[0]); // OK - tuple like usage. 
+  sink(arr[0]); // OK - tuple like usage.
 
   for (const x of arr) {
     sink(x); // NOT OK
@@ -59,7 +57,7 @@
   for (const x of [...arr]) {
     sink(x); // NOT OK
   }
-  
+
   var arr7 = [];
   arr7.push(...arr);
   for (const x of arr7) {
@@ -82,4 +80,7 @@
   }
 
   sink(arr.at(-1)); // NOT OK
+
+  sink(["source"].filter((x) => x)); // NOT OK
+  sink(["source"].filter((x) => !!x)); // NOT OK
 });