Merge pull request #22784 from asgerf/js/fix-member-token

JS: Fix parsing of Member[num] token in summaries

Author: asgerf

javascript/ql/lib/semmle/javascript/dataflow/internal/FlowSummaryPrivate.qll

@@ -252,7 +252,10 @@ ArgumentPosition decodeUnknownArgumentPosition(AccessPathSyntax::AccessPathToken
  * `encodeContent` predicate.
  */
 bindingset[token]
-ContentSet decodeUnknownContent(AccessPathSyntax::AccessPathTokenBase token) { none() }
+ContentSet decodeUnknownContent(AccessPathSyntax::AccessPathTokenBase token) {
+  token.getName() = "Member" and
+  result.asPropertyName() = token.getAnArgument()
+}
 
 /**
  * Gets a return kind corresponding to the unknown token `token`.

javascript/ql/test/library-tests/FlowSummary/DataFlowConsistency.expected

@@ -18,6 +18,7 @@ postIsInSameCallable
 reverseRead
 | tst.js:109:11:113:3 | [dynamic parameter array] | Origin of readStep is missing a PostUpdateNode. |
 | tst.js:267:28:267:31 | map3 | Origin of readStep is missing a PostUpdateNode. |
+| tst.js:305:30:305:43 | constructedMap | Origin of readStep is missing a PostUpdateNode. |
 argHasPostUpdate
 postWithInFlow
 viableImplInCallContextTooLarge

javascript/ql/test/library-tests/FlowSummary/tst.js

@@ -299,3 +299,11 @@ function m18() {
   sink(dynamicParam1("safe", ...[source()])); // NOT OK
   sink(dynamicParam1(source(), ...["safe"])); // OK
 }
+
+function m19() {
+  const constructedMap = new Map([["key", source()]]);
+  for (const [key, value] of constructedMap) {
+    sink(key);   // OK
+    sink(value); // NOT OK
+  }
+}