JS: Add taint step for shift()

Author: asgerf

javascript/ql/lib/semmle/javascript/internal/flow_summaries/Arrays.qll

@@ -486,6 +486,11 @@ class Shift extends SummarizedCallable {
     preservesValue = true and
     input = "Argument[this].ArrayElement[0]" and
     output = "ReturnValue"
+    or
+    // ArrayElement[0] is not automatically converted to a taint step, so add it manually
+    preservesValue = false and
+    input = "Argument[this]" and
+    output = "ReturnValue"
   }
 }
 

javascript/ql/test/library-tests/TripleDot/arrays.js

@@ -13,3 +13,10 @@ function shiftUnknown() {
     sink(array.shift()); // $ hasValueFlow=shift.unkn
     sink(array.shift()); // $ hasValueFlow=shift.unkn
 }
+
+function shiftTaint() {
+    const array = source('shift.directly-tainted');
+    sink(array.shift()); // $ hasTaintFlow=shift.directly-tainted
+    sink(array.shift()); // $ hasTaintFlow=shift.directly-tainted
+    sink(array.shift()); // $ hasTaintFlow=shift.directly-tainted
+}