Merge pull request #9324 from hvitved/dataflow/prohibits-use-use-fix-join

Data flow: Fix bad join in `prohibitsUseUseFlow`

Author: nickrolfe

csharp/ql/lib/semmle/code/csharp/dataflow/internal/FlowSummaryImpl.qll

@@ -777,10 +777,10 @@ module Private {
     predicate prohibitsUseUseFlow(ArgNode arg, SummarizedCallable sc) {
       exists(ParamNode p, Node mid, ParameterPosition ppos, Node ret |
         p = summaryArgParam0(_, arg, sc) and
-        p.isParameterOf(_, ppos) and
+        p.isParameterOf(_, pragma[only_bind_into](ppos)) and
         summaryLocalStep(p, mid, true) and
         summaryLocalStep(mid, ret, true) and
-        isParameterPostUpdate(ret, _, ppos)
+        isParameterPostUpdate(ret, _, pragma[only_bind_into](ppos))
       |
         summaryClearsContent(mid, _) or
         summaryExpectsContent(mid, _)

java/ql/lib/semmle/code/java/dataflow/internal/FlowSummaryImpl.qll

@@ -777,10 +777,10 @@ module Private {
     predicate prohibitsUseUseFlow(ArgNode arg, SummarizedCallable sc) {
       exists(ParamNode p, Node mid, ParameterPosition ppos, Node ret |
         p = summaryArgParam0(_, arg, sc) and
-        p.isParameterOf(_, ppos) and
+        p.isParameterOf(_, pragma[only_bind_into](ppos)) and
         summaryLocalStep(p, mid, true) and
         summaryLocalStep(mid, ret, true) and
-        isParameterPostUpdate(ret, _, ppos)
+        isParameterPostUpdate(ret, _, pragma[only_bind_into](ppos))
       |
         summaryClearsContent(mid, _) or
         summaryExpectsContent(mid, _)

ruby/ql/lib/codeql/ruby/dataflow/internal/FlowSummaryImpl.qll

@@ -777,10 +777,10 @@ module Private {
     predicate prohibitsUseUseFlow(ArgNode arg, SummarizedCallable sc) {
       exists(ParamNode p, Node mid, ParameterPosition ppos, Node ret |
         p = summaryArgParam0(_, arg, sc) and
-        p.isParameterOf(_, ppos) and
+        p.isParameterOf(_, pragma[only_bind_into](ppos)) and
         summaryLocalStep(p, mid, true) and
         summaryLocalStep(mid, ret, true) and
-        isParameterPostUpdate(ret, _, ppos)
+        isParameterPostUpdate(ret, _, pragma[only_bind_into](ppos))
       |
         summaryClearsContent(mid, _) or
         summaryExpectsContent(mid, _)