codeql/javascript/ql/test/library-tests/TaintTracking/constructor-calls.js

class EcmaClass {
  constructor(param) {
    this.param = param;
    this.taint = source();
  }
}

function JsClass(param) {
  this.param = param;
  this.taint = source();
}

class SubClass extends EcmaClass {
  constructor(param) {
    super(param);
  }
}

function test() {
  let taint = source();

  let c = new EcmaClass(taint);
  sink(c.param); // NOT OK
  sink(c.taint); // NOT OK

  let c_safe = new EcmaClass("safe");
  sink(c_safe.param); // OK
  sink(c_safe.taint); // NOT OK

  let d = new JsClass(taint);
  sink(d.param); // NOT OK
  sink(d.taint); // NOT OK

  let d_safe = new JsClass("safe");
  sink(d_safe.param); // OK
  sink(d_safe.taint); // NOT OK

  let e = new SubClass(taint);
  sink(e.param); // NOT OK
  sink(e.taint); // NOT OK

  let f_safe = new SubClass("safe");
  sink(f_safe.param); // OK
  sink(f_safe.taint); // NOT OK
}