JS: Add a missing needsDefNode restriction

asgerf · asgerf · commit 69857e30955d · 2025-11-28T10:19:49.000+01:00
Previously this was implied by MkClassInstance but that's no longer
the case.
diff --git a/javascript/ql/lib/semmle/javascript/ApiGraphs.qll b/javascript/ql/lib/semmle/javascript/ApiGraphs.qll
@@ -1532,6 +1532,7 @@ module API {
           succ = MkDef(rhs)
           or
           exists(DataFlow::ClassNode cls |
+            needsDefNode(cls) and
             cls.getAnInstanceReference().flowsTo(rhs) and
             succ = MkClassInstance(cls)
           )

Original file line number	Diff line number	Diff line change
`@@ -1532,6 +1532,7 @@ module API {`
`1532`	`1532`	`succ = MkDef(rhs)`
`1533`	`1533`	`or`
`1534`	`1534`	`exists(DataFlow::ClassNode cls \|`
	`1535`	`+ needsDefNode(cls) and`
`1535`	`1536`	`cls.getAnInstanceReference().flowsTo(rhs) and`
`1536`	`1537`	`succ = MkClassInstance(cls)`
`1537`	`1538`	`)`