JS: add class-field flowstep to js/shell-command-constructed-from-input

[erik-krogh]

Regains TP/TN for CVE-2018-3746 and CVE-2020-4066.

Those two CVEs were lost with #4460.
A simple solution would have been to revert that PR.
But with this solution we can keep the precision gain from #4460, while still getting TPs on the two CVEs.

---

I wondering if we should promote this flow-step to all taint/data-flow queries?
Because without it we miss the following:

class Foo {
  constructor() {
    this.bar = SOURCE;
  }
  baz() {
    var SINK = this.bar; 
  }
}

We only get the above flow if there is some call to baz() (which seems to connect the this nodes).

[esbena]

LGTM

I wondering if we should promote this flow-step to all taint/data-flow queries?

I think we have discussed such field taint before, and chosen not to make the promotion.
But perhaps that discussion was in the more general context of field flow between class methods that were invoked at different times.. Which would be more prone to false positives.
Lets create a promotion issue if the evaluation is fine.

[erik-krogh]

The evaluation looks fine.
(The Relay result was a fluke, a rerun looks fine).