Limit wrapper call argument steps

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 8390a2d1-70e3-4a01-84d3-3e5747d5da0b

Author: jacknojo

javascript/ql/lib/semmle/javascript/dataflow/internal/FunctionWrapperSteps.qll

@@ -155,7 +155,12 @@ private DataFlow::SourceNode forwardedCalleeSource(
   exists(DataFlow::TypeBackTracker t2 | result = forwardedCalleeSource(call, t2).backtrack(t2, t))
 }
 
-/** Data flow into a concrete function invoked through a forwarding wrapper. */
+/**
+ * Data flow into a concrete function invoked through a forwarding wrapper.
+ *
+ * Only arguments with a statically known position and a corresponding non-rest parameter are
+ * modeled.
+ */
 private class FunctionWrapperCallStep extends DataFlow::SharedFlowStep {
   DataFlow::CallNode call;
   DataFlow::FunctionNode wrapped;
@@ -167,8 +172,11 @@ private class FunctionWrapperCallStep extends DataFlow::SharedFlowStep {
 
   override predicate step(DataFlow::Node pred, DataFlow::Node succ) {
     exists(int index |
+      // getArgument only has a result when the argument position is statically known.
       pred = call.getArgument(index) and
-      succ = wrapped.getParameter(index)
+      succ = wrapped.getParameter(index) and
+      // A rest parameter receives an array, not the argument at this index.
+      not succ.(DataFlow::ParameterNode).isRestParameter()
     )
   }
 }