JS: Taint propagation from low-level ArrayBuffer to Strings

javascript/ql/test/library-tests/TaintTracking/BasicTaintTracking.expected

@@ -45,6 +45,10 @@ consistencyIssue
 | nested-props.js:20 | expected an alert, but found none | NOT OK - but not found | Consistency |
 | stringification-read-steps.js:17 | expected an alert, but found none | NOT OK | Consistency |
 | stringification-read-steps.js:25 | expected an alert, but found none | NOT OK | Consistency |
+| typed-arrays.js:22 | expected an alert, but found none | NOT OK | Consistency |
+| typed-arrays.js:26 | expected an alert, but found none | NOT OK | Consistency |
+| typed-arrays.js:30 | expected an alert, but found none | NOT OK | Consistency |
+| typed-arrays.js:34 | expected an alert, but found none | NOT OK | Consistency |
 flow
 | access-path-sanitizer.js:2:18:2:25 | source() | access-path-sanitizer.js:4:8:4:12 | obj.x |
 | addexpr.js:4:10:4:17 | source() | addexpr.js:7:8:7:8 | x |

javascript/ql/test/library-tests/TaintTracking/typed-arrays.js

@@ -16,4 +16,20 @@ function test() {
 
     const sub = y.subarray(1, 3)
     sink(sub); // NOT OK
+
+    const buffer = new ArrayBuffer(x);
+    const view = new Uint8Array(buffer);
+    sink(view); // NOT OK
+
+    const sharedBuffer = new SharedArrayBuffer(x);
+    const view1 = new Uint8Array(sharedBuffer);
+    sink(view1); // NOT OK
+
+    const transfered = buffer.transfer();
+    const transferedView = new Uint8Array(transfered);
+    sink(transferedView); // NOT OK
+
+    const transfered2 = buffer.transferToFixedLength();
+    const transferedView2 = new Uint8Array(transfered2);
+    sink(transferedView2); // NOT OK
 }