JS: Bugfix in Array constructor summary

asgerf · asgerf · commit cd3909245d98 · 2025-03-14T23:08:22.000+01:00
diff --git a/javascript/ql/lib/semmle/javascript/internal/flow_summaries/Arrays.qll b/javascript/ql/lib/semmle/javascript/internal/flow_summaries/Arrays.qll
@@ -96,7 +96,8 @@ class ArrayConstructorSummary extends SummarizedCallable {
   ArrayConstructorSummary() { this = "Array constructor" }
 
   override DataFlow::InvokeNode getACallSimple() {
-    result = arrayConstructorRef().getAnInvocation()
+    result = arrayConstructorRef().getAnInvocation() and
+    result.getNumArgument() > 1
   }
 
   override predicate propagatesFlow(string input, string output, boolean preservesValue) {

Original file line number	Diff line number	Diff line change
`@@ -96,7 +96,8 @@ class ArrayConstructorSummary extends SummarizedCallable {`
`96`	`96`	`ArrayConstructorSummary() { this = "Array constructor" }`
`97`	`97`
`98`	`98`	`override DataFlow::InvokeNode getACallSimple() {`
`99`		`- result = arrayConstructorRef().getAnInvocation()`
	`99`	`+ result = arrayConstructorRef().getAnInvocation() and`
	`100`	`+ result.getNumArgument() > 1`
`100`	`101`	`}`
`101`	`102`
`102`	`103`	`override predicate propagatesFlow(string input, string output, boolean preservesValue) {`