revert Array.from change

Author: erik-krogh

javascript/ql/src/semmle/javascript/dataflow/Nodes.qll

@@ -598,23 +598,18 @@ class ArrayConstructorInvokeNode extends DataFlow::InvokeNode {
  * new Array('apple', 'orange')
  * Array(16)
  * new Array(16)
- * Array.from(1,2,3);
  * ```
  */
 class ArrayCreationNode extends DataFlow::ValueNode, DataFlow::SourceNode {
   ArrayCreationNode() {
     this instanceof ArrayLiteralNode or
-    this instanceof ArrayConstructorInvokeNode or
-    this = DataFlow::globalVarRef("Array").getAPropertyRead("from").getACall()
+    this instanceof ArrayConstructorInvokeNode
   }
 
   /** Gets the `i`th initial element of this array, if one is provided. */
   DataFlow::ValueNode getElement(int i) {
     result = this.(ArrayLiteralNode).getElement(i) or
-    result = this.(ArrayConstructorInvokeNode).getElement(i) or
-    exists(DataFlow::CallNode call | call.getCalleeName() = "from" and call = this | 
-      result = call.getArgument(i)
-    )
+    result = this.(ArrayConstructorInvokeNode).getElement(i)
   }
 
   /** Gets an initial element of this array, if one if provided. */
@@ -623,10 +618,7 @@ class ArrayCreationNode extends DataFlow::ValueNode, DataFlow::SourceNode {
   /** Gets the initial size of the created array, if it can be determined. */
   int getSize() {
     result = this.(ArrayLiteralNode).getSize() or
-    result = this.(ArrayConstructorInvokeNode).getSize() or
-    exists(DataFlow::CallNode call | call.getCalleeName() = "from" and call = this | 
-      result = call.getNumArgument()
-    )
+    result = this.(ArrayConstructorInvokeNode).getSize()
   }
 }
 

javascript/ql/test/library-tests/Arrays/DataFlow.expected

@@ -4,10 +4,10 @@
 | arrays.js:2:16:2:23 | "source" | arrays.js:16:23:16:23 | e |
 | arrays.js:2:16:2:23 | "source" | arrays.js:20:8:20:16 | arr.pop() |
 | arrays.js:18:22:18:29 | "source" | arrays.js:18:50:18:50 | e |
-| arrays.js:22:25:22:32 | "source" | arrays.js:23:8:23:17 | arr2.pop() |
+| arrays.js:22:15:22:22 | "source" | arrays.js:23:8:23:17 | arr2.pop() |
 | arrays.js:25:15:25:22 | "source" | arrays.js:26:8:26:17 | arr3.pop() |
 | arrays.js:29:21:29:28 | "source" | arrays.js:30:8:30:17 | arr4.pop() |
 | arrays.js:29:21:29:28 | "source" | arrays.js:33:8:33:17 | arr5.pop() |
 | arrays.js:29:21:29:28 | "source" | arrays.js:35:8:35:26 | arr5.slice(2).pop() |
 | arrays.js:29:21:29:28 | "source" | arrays.js:41:8:41:17 | arr6.pop() |
-| arrays.js:44:14:44:21 | "source" | arrays.js:45:10:45:18 | ary.pop() |
+| arrays.js:44:4:44:11 | "source" | arrays.js:45:10:45:18 | ary.pop() |

javascript/ql/test/library-tests/Arrays/arrays.js

@@ -19,7 +19,7 @@
 
   sink(arr.pop()); // NOT OK
 
-  var arr2 = Array.from("source");
+  var arr2 = ["source"];
   sink(arr2.pop()); // NOT OK
 
   var arr3 = ["source"];
@@ -41,7 +41,7 @@
   sink(arr6.pop()); // NOT OK
 
 
-  Array.from("source").forEach((e, i, ary) => {
+  ["source"].forEach((e, i, ary) => {
     sink(ary.pop()); // NOT OK
     sink(ary); // OK - its the array itself, not an element.
   })