JavaScript: Recognise rest patterns as lvalues.

Author: Max Schaefer

javascript/ql/src/semmle/javascript/DefUse.qll

@@ -98,7 +98,8 @@ private predicate lvalAux(Expr l, ControlFlowNode def) {
   exists (ArrayPattern ap | lvalAux(ap, def) | l = ap.getAnElement().stripParens())
   or
   exists (ObjectPattern op | lvalAux(op, def) |
-    l = op.getAPropertyPattern().getValuePattern().stripParens()
+    l = op.getAPropertyPattern().getValuePattern().stripParens() or
+    l = op.getRest().stripParens()
   )
 }
 

javascript/ql/test/query-tests/Declarations/MissingVarDecl/MissingVarDecl.expected

@@ -4,3 +4,5 @@
 | test.js:54:10:54:10 | z | Variable z is used like a local variable, but is missing a declaration. |
 | test.js:60:6:60:6 | y | Variable y is used like a local variable, but is missing a declaration. |
 | test.js:66:2:66:2 | z | Variable z is used like a local variable, but is missing a declaration. |
+| tst3.js:7:10:7:10 | x | Variable x is used like a local variable, but is missing a declaration. |
+| tst3.js:7:16:7:19 | rest | Variable rest is used like a local variable, but is missing a declaration. |

javascript/ql/test/query-tests/Declarations/MissingVarDecl/tst3.js

@@ -2,3 +2,8 @@ function sc_alert(i) {
    for(;i;) ;
    foo;
 }
+
+function f(o) {
+    for({x, ...rest} of o)
+        console.log(x in rest);
+}