JS: suppress similar alerts from RemotePropertyInjection

javascript/ql/src/semmle/javascript/security/dataflow/RemotePropertyInjection.qll

@@ -70,15 +70,25 @@ module RemotePropertyInjection {
       result = " a property name to write to."
     }     
   }
+
+  /**
+   * Holds if the method name injection on the given base object is handled by another query.
+   */
+  private predicate isCoveredByMethodNameInjection(DataFlow::SourceNode node) {
+    node = DataFlow::globalObjectRef()
+    or
+    node.analyze().getAValue() instanceof AbstractCallable
+  }
   
   /**
    * A sink for method calls using dynamically computed method names.   
    */
   class MethodCallSink extends Sink, DataFlow::ValueNode  {
     MethodCallSink() {
-      exists (DataFlow::PropRead pr | astNode = pr.getPropertyNameExpr() |           
-        exists (pr.getAnInvocation())
-      )          
+      exists (DataFlow::PropRead pr | astNode = pr.getPropertyNameExpr() |
+        exists (pr.getAnInvocation()) and
+        not isCoveredByMethodNameInjection(pr.getBase().getALocalSource())
+      )
     }
 
     override string getMessage() {

javascript/ql/test/query-tests/Security/CWE-400/tst.js

@@ -14,7 +14,8 @@ app.get('/user/:id', function(req, res) {
 	Object.defineProperty(myObj, prop, {value: 24}); // NOT OK
 	var headers = {};	
 	headers[prop] = 42; // NOT OK
-	res.set(headers);	
+	res.set(headers);
+	myCoolLocalFct[req.query.x](); // OK - flagged by method name injection
 });
 
 function myCoolLocalFct(x) {