JS: Improve support for NodeJS pipe callbacks

[MathiasVP]

The gist of these changes is to add modeling for:

class PipedDestination extends Writable {
  write(chunk) {
    sink(chunk);
    return true;
  }
}

Readable.from([source()]).pipe(new PipedDestination());

This is done in f083ced. However, Copilot kept informing me of other, related, APIs that should also have modeling. And thus comes the flurry of subsequent commits that add more modeling 😰

I've done my best to babysit Copilot so that the code looks reasonable, and the commits are somewhat reviewable.

DCA looks uneventful (after some join order fixes in a couple of queries)

[Copilot]

🔵 Needs a closer look

The extensive call-graph and synthesized-node modeling warrants final human validation for precision and performance.

0 open findings

What changed in this PR

Improves JavaScript data-flow modeling for Node.js stream pipelines and their callbacks.

Changes:

• Models chunks from Readable.from through pipe, write, _write, and _transform.
• Preserves piped file-stream data as filesystem-read sources.
• Adds extensive stream-flow tests and query join-order hints.

File	Description
javascript/​ql/​lib/​semmle/​javascript/​frameworks/​NodeJSLib.qll	Adds stream pipeline and callback modeling.
javascript/​ql/​lib/​semmle/​javascript/​security/​dataflow/​ReflectedXssCustomizations.qll	Adds optimizer binding hints.
javascript/​ql/​lib/​semmle/​javascript/​security/​dataflow/​UnsafeJQueryPluginCustomizations.qll	Adds optimizer binding hints.
javascript/​ql/​lib/​change-notes/​2026-10-12-nodejs-stream-pipe.md	Documents improved stream modeling.
javascript/​ql/​test/​library-tests/​frameworks/​NodeJSLib/​StreamPipeDataFlow.ql	Defines stream flow assertions.
javascript/​ql/​test/​library-tests/​frameworks/​NodeJSLib/​StreamPipeDataFlow.expected	Provides generated test expectations.
javascript/​ql/​test/​library-tests/​frameworks/​NodeJSLib/​stream-pipe.js	Exercises stream and transform scenarios.
javascript/​ql/​test/​library-tests/​frameworks/​Concepts/​file-access.js	Tests piped filesystem reads.
javascript/​ql/​test/​library-tests/​frameworks/​Concepts/​tests.expected	Updates generated concept expectations.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[MathiasVP]

Gee, thanks a lot for this in-depth review, Copilot.