JS: "this" in a template is not the global object

asgerf · asgerf · commit 623557ba39ec · 2021-08-11T12:36:35.000+02:00
diff --git a/javascript/ql/src/semmle/javascript/dataflow/Nodes.qll b/javascript/ql/src/semmle/javascript/dataflow/Nodes.qll
@@ -374,7 +374,8 @@ DataFlow::SourceNode globalObjectRef() {
   // top-level `this`
   exists(StmtContainer sc |
     sc = result.(ThisNode).getBindingContainer() and
-    not sc instanceof Function
+    not sc instanceof Function and
+    not sc instanceof Templating::TemplateTopLevel
   )
   or
   // DOM
