JS: Refine criteria so that explicit this-passing is not affected

asgerf · asgerf · commit 8815c924300d · 2025-10-31T09:53:00.000+01:00
diff --git a/javascript/ql/lib/semmle/javascript/ApiGraphs.qll b/javascript/ql/lib/semmle/javascript/ApiGraphs.qll
@@ -1338,7 +1338,9 @@ module API {
         exists(DataFlow::TypeTracker t, StepSummary summary, DataFlow::SourceNode prev |
           prev = trackUseNode(nd, promisified, boundArgs, prop, t) and
           StepSummary::step(prev, res, summary) and
-          result = t.append(summary)
+          result = t.append(summary) and
+          // Block argument-passing into 'this' when it determines the call target
+          not summary = CallReceiverStep()
         )
       }
 

Original file line number	Diff line number	Diff line change
`@@ -1338,7 +1338,9 @@ module API {`
`1338`	`1338`	`exists(DataFlow::TypeTracker t, StepSummary summary, DataFlow::SourceNode prev \|`
`1339`	`1339`	`prev = trackUseNode(nd, promisified, boundArgs, prop, t) and`
`1340`	`1340`	`StepSummary::step(prev, res, summary) and`
`1341`		`- result = t.append(summary)`
	`1341`	`+ result = t.append(summary) and`
	`1342`	`+ // Block argument-passing into 'this' when it determines the call target`
	`1343`	`+ not summary = CallReceiverStep()`
`1342`	`1344`	`)`
`1343`	`1345`	`}`
`1344`	`1346`