JavaScript: Add new tests.

Author: Max Schaefer

javascript/ql/test/library-tests/InterProceduralFlow/TaintTracking.expected

@@ -36,6 +36,9 @@
 | tst2.js:3:17:3:26 | "tainted2" | tst2.js:11:15:11:24 | g(source2) |
 | tst2.js:6:24:6:37 | "also tainted" | tst2.js:10:15:10:24 | g(source1) |
 | tst2.js:6:24:6:37 | "also tainted" | tst2.js:11:15:11:24 | g(source2) |
+| tst4.js:2:16:2:24 | "tainted" | tst4.js:15:15:15:31 | id(still_tainted) |
+| tst4.js:2:16:2:24 | "tainted" | tst4.js:16:15:16:28 | p.also_tainted |
+| tst4.js:2:16:2:24 | "tainted" | tst4.js:17:15:17:28 | substr(source) |
 | tst.js:2:17:2:22 | "src1" | tst.js:3:15:3:29 | String(source1) |
 | tst.js:2:17:2:22 | "src1" | tst.js:4:15:4:29 | RegExp(source1) |
 | tst.js:2:17:2:22 | "src1" | tst.js:5:15:5:33 | new String(source1) |

javascript/ql/test/library-tests/InterProceduralFlow/tst4.js

@@ -0,0 +1,18 @@
+(function(p) {
+  let source = "tainted";
+
+  function id(x) {
+    return x;
+  }
+
+  function substr(x) {
+    return x.substring(2);
+  }
+
+  var still_tainted = source.substring(2);
+  p.also_tainted = still_tainted;
+
+  let sink1 = id(still_tainted);
+  let sink2 = p.also_tainted;
+  let sink3 = substr(source);
+});