JS: Note issue with .apply() calls

Author: asgerf

javascript/ql/lib/semmle/javascript/dataflow/internal/TaintTrackingPrivate.qll

@@ -25,6 +25,7 @@ predicate defaultAdditionalTaintStep(DataFlow::Node node1, DataFlow::Node node2)
     node1 = TValueNode(invoke.getAnArgument().stripParens().(SpreadElement).getOperand()) and
     node2 = TDynamicArgumentStoreNode(invoke, c) and
     c.isUnknownArrayElement()
+    // TODO: we need a similar case for .apply() calls
   )
 }
 

javascript/ql/test/library-tests/TaintTracking/array-mutation.js

@@ -29,11 +29,11 @@ function test(x, y) {
 
   let h = [];
   Array.prototype.push.apply(h, source());
-  sink(h); // NOT OK
+  sink(h); // NOT OK [INCONSISTENCY]
 
   let i = [];
   Array.prototype.unshift.apply(i, source());
-  sink(i); // NOT OK
+  sink(i); // NOT OK [INCONSISTENCY]
 
   let j = [];
   j[j.length] = source();