Missing code injection TP in JavaScript rule

The thing is, if I have this code:
```javascript
JSON.parse = function(text, reviver) {
j = eval("(" + text + ")");
};
JSON.parse(window.location.href);
```
CodeQL reported an alert:
```csv
"Code injection","Interpreting unsanitized user input as code allows a malicious user arbitrary code execution.","error","This code execution depends on a [[""user-provided value""|""relative:///test.js:5:12:5:31""]].","/test.js","3","14","3","29"
```
But if I separate the file saying:
`./lib1.js`:
```javascript
JSON.parse = function(text, reviver) {
j = eval("(" + text + ")");
};
```
`./main.js`
```javascript
require("./lib1");
// JSON.parse = function(text, reviver) {
// j = eval("(" + text + ")");
// };
JSON.parse(window.location.href);
```
I can't get that alert anymore. Why did that happen?

I was using codeql and query pack version release 2.20.4.

Reproduce the alert difference using the issue's test.js, lib1.js, and main.js examples with the reported CodeQL query pack version. Then trace the JavaScript rule's handling of assignments and calls across required files; done means identifying whether the missing alert is expected behavior or a cross-file analysis bug and documenting the finding or regression coverage.

Scritto dal modello di indicizzazione a partire dal testo della issue.