Do not pass regular positional args into the rest parameter

asgerf · asgerf · commit 623dbda77ddd · 2024-08-27T11:35:14.000+02:00
diff --git a/javascript/ql/lib/semmle/javascript/dataflow/internal/DataFlowPrivate.qll b/javascript/ql/lib/semmle/javascript/dataflow/internal/DataFlowPrivate.qll
@@ -287,7 +287,11 @@ abstract class LibraryCallable extends string {
 }
 
 private predicate isParameterNodeImpl(Node p, DataFlowCallable c, ParameterPosition pos) {
-  p = c.asSourceCallable().(Function).getParameter(pos.asPositional()).flow()
+  exists(Parameter parameter |
+    parameter = c.asSourceCallable().(Function).getParameter(pos.asPositional()) and
+    not parameter.isRestParameter() and
+    p = TValueNode(parameter)
+  )
   or
   pos.isThis() and p = TThisNode(c.asSourceCallable().(Function))
   or
