Merge pull request #3154 from erik-krogh/ImplicitConv

Approved by asgerf

javascript/ql/src/Expressions/ImplicitOperandConversion.ql

@@ -162,7 +162,26 @@ abstract class NullOrUndefinedConversion extends ImplicitConversion {
 class PlusConversion extends NullOrUndefinedConversion {
   PlusConversion() { parent instanceof AddExpr or parent instanceof AssignAddExpr }
 
-  override string getConversionTarget() { result = "number or string" }
+  override string getConversionTarget() {
+    result = getDefiniteSiblingType()
+    or
+    not exists(getDefiniteSiblingType()) and
+    result = "number or string"
+  }
+
+  /**
+   * Gets the sibling of this implicit conversion.
+   * E.g. if this is `a` in the expression `a + b`, then the sibling is `b`.
+   */
+  private Expr getSibling() { result = parent.getAChild() and not result = this.getEnclosingExpr() }
+
+  /**
+   * Gets the unique type of the sibling expression, if that type is `string` or `number`.
+   */
+  private string getDefiniteSiblingType() {
+    result = unique(InferredType t | t = getSibling().flow().analyze().getAType()).getTypeofTag() and
+    result = ["string", "number"]
+  }
 }
 
 /**