add lValueFlowStep for rest-pattern nested inside a property-pattern (and removed old incorrect approach)

Author: erik-krogh

javascript/ql/src/semmle/javascript/DefUse.qll

@@ -85,12 +85,6 @@ private predicate defn(ControlFlowNode def, Expr lhs) {
   exists(EnumMember member | def = member.getIdentifier() |
     lhs = def and not exists(member.getInitializer())
   )
-  or
-  exists(PropertyPattern prop, ObjectPattern obj, Expr rest |
-    prop.getValuePattern() = obj and obj.getRest() = rest
-  |
-    lhs = rest and def = prop
-  )
 }
 
 /**

javascript/ql/src/semmle/javascript/dataflow/DataFlow.qll

@@ -1347,6 +1347,11 @@ module DataFlow {
       succ = lvalueNode(pattern.getValuePattern())
     )
     or
+    exists(PropertyPattern pattern | 
+      pred = TPropNode(pattern) and
+      succ = lvalueNode(pattern.getValuePattern().(ObjectPattern).getRest())
+    )
+    or
     exists(Expr element |
       pred = TElementPatternNode(_, element) and
       succ = lvalueNode(element)
@@ -1386,11 +1391,6 @@ module DataFlow {
       succ = valueNode(v.getAUse())
     )
     or
-    exists(SsaExplicitDefinition def |
-      pred.getAstNode() = def.getDef() and
-      succ = TSsaDefNode(def)
-    )
-    or
     exists(Expr predExpr, Expr succExpr |
       pred = valueNode(predExpr) and succ = valueNode(succExpr)
     |

javascript/ql/test/query-tests/Security/CWE-078/IndirectCommandInjection.expected

@@ -79,7 +79,7 @@ nodes
 | command-line-parameter-command-injection.js:43:22:43:58 | require ... parse() |
 | command-line-parameter-command-injection.js:43:22:43:58 | require ... parse() |
 | command-line-parameter-command-injection.js:43:22:43:62 | require ... e().foo |
-| command-line-parameter-command-injection.js:48:3:50:3 | args |
+| command-line-parameter-command-injection.js:47:8:53:12 | args |
 | command-line-parameter-command-injection.js:48:3:50:3 | argv: { ... rgs\\n\\t\\t} |
 | command-line-parameter-command-injection.js:48:3:50:3 | argv: { ... rgs\\n\\t\\t} |
 | command-line-parameter-command-injection.js:55:10:55:25 | "cmd.sh " + args |
@@ -155,9 +155,9 @@ edges
 | command-line-parameter-command-injection.js:43:22:43:58 | require ... parse() | command-line-parameter-command-injection.js:43:22:43:62 | require ... e().foo |
 | command-line-parameter-command-injection.js:43:22:43:62 | require ... e().foo | command-line-parameter-command-injection.js:43:10:43:62 | "cmd.sh ... e().foo |
 | command-line-parameter-command-injection.js:43:22:43:62 | require ... e().foo | command-line-parameter-command-injection.js:43:10:43:62 | "cmd.sh ... e().foo |
-| command-line-parameter-command-injection.js:48:3:50:3 | args | command-line-parameter-command-injection.js:55:22:55:25 | args |
-| command-line-parameter-command-injection.js:48:3:50:3 | argv: { ... rgs\\n\\t\\t} | command-line-parameter-command-injection.js:48:3:50:3 | args |
-| command-line-parameter-command-injection.js:48:3:50:3 | argv: { ... rgs\\n\\t\\t} | command-line-parameter-command-injection.js:48:3:50:3 | args |
+| command-line-parameter-command-injection.js:47:8:53:12 | args | command-line-parameter-command-injection.js:55:22:55:25 | args |
+| command-line-parameter-command-injection.js:48:3:50:3 | argv: { ... rgs\\n\\t\\t} | command-line-parameter-command-injection.js:47:8:53:12 | args |
+| command-line-parameter-command-injection.js:48:3:50:3 | argv: { ... rgs\\n\\t\\t} | command-line-parameter-command-injection.js:47:8:53:12 | args |
 | command-line-parameter-command-injection.js:55:22:55:25 | args | command-line-parameter-command-injection.js:55:10:55:25 | "cmd.sh " + args |
 | command-line-parameter-command-injection.js:55:22:55:25 | args | command-line-parameter-command-injection.js:55:10:55:25 | "cmd.sh " + args |
 #select