JS: Generate flow summaries from summaryModels; only generate steps as a fallback

[asgerf]

Makes the JavaScript analysis generate flow summaries from summaryModel rows, and only generate steps if the flow summary library does not support the input/output pair.

[Copilot]

Pull Request Overview

This PR enhances JavaScript data-flow analysis by using summaryModel rows for flows and falling back to step generation only when the summary library does not support a given input/output pair.

• Introduces predicates in FlowSummaryImpl.qll to detect supported input/output stacks and flag unsupported callables.
• Removes old summary-step logic from ApiGraphModelsSpecific.qll and centralizes fallback logic in ModelsAsData.qll.
• Updates test expectations to reflect new fallback steps and library-only flows.

Reviewed Changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
shared/dataflow/codeql/dataflow/internal/FlowSummaryImpl.qll	Added isSupportedInputStack, isSupportedOutputStack, and unsupportedCallable predicates
javascript/ql/lib/semmle/javascript/frameworks/data/internal/ApiGraphModelsSpecific.qll	Removed old summary-step and input/output path predicates; delegating to new fallback mechanism
javascript/ql/lib/semmle/javascript/frameworks/data/ModelsAsData.qll	Imported FlowSummaryPrivate, defined SummarizedCallableFromModel, and integrated fallback step logic
javascript/ql/lib/semmle/javascript/dataflow/internal/FlowSummaryPrivate.qll	Exposed unsupportedCallable predicates for use in dataflow
javascript/ql/test/query-tests/Security/CWE-079/ReflectedXss/ReflectedXss.expected	Updated expected edges/nodes to include fallback-generated steps
javascript/ql/test/library-tests/frameworks/data/test.expected	Updated expected flows to reflect library-only and fallback behavior
javascript/ql/test/library-tests/TripleDot/underscore.string.js	Adjusted expected taint-flow annotation to match new test behavior

Comments suppressed due to low confidence (2)

javascript/ql/lib/semmle/javascript/dataflow/internal/FlowSummaryPrivate.qll:268

• [nitpick] The predicate 'unsupportedCallable' is overloaded with arity 1 and 4, which may be confusing. Consider renaming one overload or adding documentation to clarify their distinct purposes.

predicate unsupportedCallable = Private::unsupportedCallable/1;

shared/dataflow/codeql/dataflow/internal/FlowSummaryImpl.qll:564

• The recursive case in isSupportedInputStack handles stacks beyond length 3; consider adding unit tests for deeper input stacks to ensure correct behavior.

isSupportedInputStack(s.tail()) and

[hvitved]

I hadn't considered the fact that we also support this case, a lambda passed in which has a side-effect on one of it's arguments.

[hvitved]

generate a

[hvitved]

We actually support just Argument[n] as well, for example one might model a string builder append method as input = Argument[0] and output = Argument[self] and preservesValue = false`.