JS: Recognize calls to .item and .namedItem

Author: asgerf

javascript/ql/src/semmle/javascript/DOM.qll

@@ -340,6 +340,9 @@ module DOM {
     t.start() and
     result = domValueSource()
     or
+    t.start() and
+    result = domValueRef().getAMethodCall(["item", "namedItem"])
+    or
     exists(DataFlow::TypeTracker t2 | result = domValueRef(t2).track(t2, t))
   }
 

javascript/ql/test/library-tests/DOM/Customizations.expected

@@ -1,8 +1,11 @@
 test_documentRef
 | customization.js:2:13:2:31 | customGetDocument() |
+| nameditems.js:1:1:1:8 | document |
 test_locationRef
 | customization.js:3:3:3:14 | doc.location |
 test_domValueRef
 | customization.js:4:3:4:28 | doc.get ... 'test') |
+| nameditems.js:1:1:1:30 | documen ... ('foo') |
+| nameditems.js:1:1:2:19 | documen ... em('x') |
 | tst.js:49:3:49:8 | window |
 | tst.js:50:3:50:8 | window |

javascript/ql/test/library-tests/DOM/nameditems.js

@@ -0,0 +1,2 @@
+document.getElementById('foo')
+    .namedItem('x');