JS: Fix join order in argumentPassing

asgerf · asgerf · commit 01fd00de564b · 2021-03-19T11:49:06.000Z
diff --git a/javascript/ql/src/semmle/javascript/dataflow/internal/FlowSteps.qll b/javascript/ql/src/semmle/javascript/dataflow/internal/FlowSteps.qll
@@ -206,10 +206,11 @@ private module CachedSteps {
       parm = DataFlow::parameterNode(f.getParameter(0))
     )
     or
-    exists(DataFlow::Node callback, int i, Parameter p |
+    exists(DataFlow::Node callback, int i, Parameter p, Function target |
       invk.(DataFlow::PartialInvokeNode).isPartialArgument(callback, arg, i) and
       partiallyCalls(invk, callback, f) and
-      f.getParameter(i) = p and
+      f = pragma[only_bind_into](target) and
+      target.getParameter(i) = p and
       not p.isRestParameter() and
       parm = DataFlow::parameterNode(p)
     )

Original file line number	Diff line number	Diff line change
`@@ -206,10 +206,11 @@ private module CachedSteps {`
`206`	`206`	`parm = DataFlow::parameterNode(f.getParameter(0))`
`207`	`207`	`)`
`208`	`208`	`or`
`209`		`- exists(DataFlow::Node callback, int i, Parameter p \|`
	`209`	`+ exists(DataFlow::Node callback, int i, Parameter p, Function target \|`
`210`	`210`	`invk.(DataFlow::PartialInvokeNode).isPartialArgument(callback, arg, i) and`
`211`	`211`	`partiallyCalls(invk, callback, f) and`
`212`		`- f.getParameter(i) = p and`
	`212`	`+ f = pragma[only_bind_into](target) and`
	`213`	`+ target.getParameter(i) = p and`
`213`	`214`	`not p.isRestParameter() and`
`214`	`215`	`parm = DataFlow::parameterNode(p)`
`215`	`216`	`)`