implement Immutable OrderedMap

Author: erik-krogh

javascript/ql/src/semmle/javascript/frameworks/Immutable.qll

@@ -35,7 +35,7 @@ private module Immutable {
    */
   API::Node immutableCollection() {
     // keep this list in sync with the constructors defined in `storeStep`.
-    result = immutableImport().getMember(["Map", "List", "fromJS"]).getReturn()
+    result = immutableImport().getMember(["Map", "OrderedMap", "List", "fromJS"]).getReturn()
     or
     result = immutableCollection().getMember(["set", "map", "filter", "push"]).getReturn()
   }
@@ -46,7 +46,7 @@ private module Immutable {
   DataFlow::SourceNode storeStep(DataFlow::Node pred, string prop) {
     // Immutable.Map() and Immutable.fromJS().
     exists(DataFlow::CallNode call |
-      call = immutableImport().getMember(["Map", "fromJS"]).getACall()
+      call = immutableImport().getMember(["Map", "OrderedMap", "fromJS"]).getACall()
     |
       pred = call.getOptionArgument(0, prop) and
       result = call

javascript/ql/test/library-tests/frameworks/Immutable/immutable.js

@@ -1,7 +1,7 @@
 var obj = { a: source("a"), b: source("b1") };
 sink(obj["a"]); // NOT OK
 
-const { Map, fromJS, List } = require('immutable');
+const { Map, fromJS, List, OrderedMap } = require('immutable');
 
 const map1 = Map(obj);
 
@@ -31,3 +31,7 @@ List(["safe"]).map(x => source()).forEach(x => sink(x)); // NOT OK
 List([source()]).map(x => x).filter(x => true).toList().forEach(x => sink(x)); // NOT OK
 
 List(["safe"]).push(source()).forEach(x => sink(x)); // NOT OK
+
+
+const map4 = OrderedMap({}).set("f", source());
+sink(map4.get("f")); // NOT OK

javascript/ql/test/library-tests/frameworks/Immutable/tests.expected

@@ -10,3 +10,4 @@
 | immutable.js:29:25:29:32 | source() | immutable.js:29:53:29:53 | x |
 | immutable.js:31:7:31:14 | source() | immutable.js:31:75:31:75 | x |
 | immutable.js:33:21:33:28 | source() | immutable.js:33:49:33:49 | x |
+| immutable.js:36:38:36:45 | source() | immutable.js:37:6:37:18 | map4.get("f") |