JS: Taint propagation from low-level ArrayBuffer to Strings

[Napalys]

This pull request introduces taint modeling for the most commonly used TypedArray, specifically the Uint8Array, which is primarily utilized in byte-to-string operations. It excludes other TypedArray types, such as Int32Array, as they are generally not associated with taint propagation.

Additionally, this update adds support for ArrayBuffer and SharedArrayBuffer, which are frequently used in low-level operations and are often passed to TypedArray constructors.

Finally, the pull request includes taint propagation for TextDecoder, as it plays a key role in converting ArrayBuffer or TypedArray data into Strings.

[Copilot]

Pull Request Overview

This pull request introduces taint propagation for low-level byte-related objects in JavaScript, ensuring that taints are maintained from ArrayBuffer through various TypedArray operations into string conversions.

• Introduces taint propagation for Uint8Array, ArrayBuffer, and SharedArrayBuffer operations.
• Adds taint tracking for TextDecoder.decode() and byte-to-string operations.

Reviewed Changes

Copilot reviewed 2 out of 7 changed files in this pull request and generated 1 comment.

File	Description
javascript/ql/test/library-tests/TaintTracking/typed-arrays.js	Adds tests for taint propagation across different TypedArray and ArrayBuffer operations
javascript/ql/lib/change-notes/2025-04-07-typed-arrays.md	Documents the minor analysis update related to taint propagation changes

Files not reviewed (5)

• javascript/ql/lib/semmle/javascript/internal/flow_summaries/AllFlowSummaries.qll: Language not supported
• javascript/ql/lib/semmle/javascript/internal/flow_summaries/Decoders.qll: Language not supported
• javascript/ql/lib/semmle/javascript/internal/flow_summaries/TypedArrays.qll: Language not supported
• javascript/ql/test/library-tests/TaintTracking/BasicTaintTracking.expected: Language not supported
• javascript/ql/test/query-tests/Security/CWE-522-DecompressionBombs/DecompressionBombs.expected: Language not supported

Tip: Copilot only keeps its highest confidence comments to reduce noise and keep you focused. Learn more

[asgerf]

One last comment otherwise LGTM