Added test cases for shelljs.env

Author: Napalys

javascript/ql/test/query-tests/Security/CWE-078/IndirectCommandInjection/actions.js

@@ -12,3 +12,10 @@ function test(e) {
 test(process.env); // $ Source
 
 exec(getInput('data')); // $ Alert
+
+function test2(e) {
+    const shelljs = require('shelljs');
+    exec('rm -rf ' + shelljs.env['SOME']); // $ MISSING: Alert
+    exec('rm -rf ' + shelljs.env.SOME); // $ MISSING: Alert
+    exec('rm -rf ' + shelljs.env); // $ MISSING: Alert
+}