JS: add whitelist to js/useless-defensive-code

javascript/ql/src/Expressions/UselessDefensiveProgramming.ql

@@ -15,5 +15,18 @@ import javascript
 import semmle.javascript.DefensiveProgramming
 
 from DefensiveExpression e, boolean cv
-where e.getTheTestResult() = cv
+where e.getTheTestResult() = cv and
+      // whitelist
+      not (
+        // module environment detection
+        exists (VarAccess access, string name |
+          name = "exports" or name = "module" |
+          e.asExpr().(Internal::TypeofUndefinedTest).getOperand() = access and
+          access.getName() = name and
+          not exists (access.getVariable().getADeclaration())
+        )
+        or
+        // too benign in practice
+        e instanceof Internal::DefensiveInit
+      )
 select e, "This guard always evaluates to " + cv + "."

javascript/ql/src/semmle/javascript/DefensiveProgramming.qll

@@ -390,7 +390,7 @@ module Internal {
   /**
    * A test for `undefined` using a `typeof` expression.
    */
-  private class TypeofUndefinedTest extends UndefinedNullTest {
+  class TypeofUndefinedTest extends UndefinedNullTest {
 
     TypeofTest test;