JS: Report command injection through child_process argument arrays when shell is enabled - #22978

Description of the fix

js/command-line-injection now reports remote input that reaches the argument array of spawn/execFile when the shell option is set to true or a nonempty string, including their synchronous variants.

const cp = require("child_process");
const app = require("express")();

app.get("/a", (req, res) => {
  cp.exec("echo hello " + req.query.name); // reported
  res.send("ok");
});

app.get("/b", (req, res) => {
  cp.spawn("echo", ["hello", req.query.name], { shell: true }); // now reported
  res.send("ok");
});

app.get("/c", (req, res) => {
  cp.spawn("echo", ["hello", req.query.name], { shell: "/bin/sh" }); // now reported
  res.send("ok");
});

All three routes are now reported by js/command-line-injection. Argument arrays in these examples with shell: false, shell: "", or no shell option remain unreported.

For child_process.spawn, spawnSync, execFile, and execFileSync, the command-injection sink modeling reuses UnsafeShellCommandConstruction::ShellTrueCommandExecutionSink. The sink is the argument array at the execution call, so array mutations must reach that call to be reported. executesArrayAsShell also recognizes nonempty string-valued shell paths and checks for local writes that overwrite the shell setting before execution.

The child_process model distinguishes argument arrays, options objects, and callbacks. It handles execFile calls with or without a callback, excludes options-only calls from argument-array sinks, and preserves js/useless-use-of-cat findings when callbacks cannot be resolved locally.

Testing

Regression fixtures and expected results cover boolean and string-valued shell options, synchronous and promisified calls, callback-free execFile, forwarded arrays/options, and push/unshift. Negative cases cover disabled, empty, omitted, and overwritten shell options, options-only calls, constant arguments, and array mutations after execution.

The CommandInjection, UnsafeShellCommandConstruction, UselessUseOfCat, and NodeJSLib test suites pass.

Fixes #22825.