JS: Improve useless-expression query to avoid duplicate alerts on compound expressions

[Napalys]

This PR improves the js/useless-expression query by adding logic to avoid flagging compound expressions that may contain sub-expressions with side effects.

[Copilot]

Pull Request Overview

Enhance the isDomProperty predicate to detect property reads on DOM nodes (e.g., offsetHeight, clientWidth) and reduce false positives in the js/useless-expression query.

• Extend isDomProperty to also match property names accessed via data-flow property reads.
• Add a test case validating layout-affecting reads on DOM elements.
• Record the change in the project’s change notes.

Reviewed Changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
javascript/ql/lib/Expressions/DOMProperties.qll	Extend isDomProperty predicate with a DataFlow::SourceNode branch.
javascript/ql/test/query-tests/Expressions/ExprHasNoEffect/dom.js	New test verifying that reads like offsetHeight and clientWidth are side-effectful.
javascript/ql/lib/change-notes/2025-05-26-dom-property-access.md	Add change note documenting the enhancement to isDomProperty.

Comments suppressed due to low confidence (1)

javascript/ql/lib/Expressions/DOMProperties.qll:14

• [nitpick] The variable name domNode implies a DOM AST node but actually refers to a data-flow source; consider renaming it to sourceNode or propSourceNode for clearer intent.

exists(DataFlow::SourceNode domNode | isDomNode(domNode) |

[asgerf]

Why this last condition about functions? Deserves a comment at least.

[Napalys]

I added this to handle cases like this one, otherwise we would lose the ability to detect such useless functions. I’ve also added a comment in commit 15b1dae. Hope that makes sense!

[asgerf]

But why is the function expression itself not flagged in this case?

We decided to alert on the innermost expression, as opposed to the outermost one. But this makes an exception for function expressions; for function expressions we now flag the enclosing parenthesis. I just don't see why there should be a special case for function expressions.

[Napalys]

That’s fair! It was silly of me to try fixing the problem at the surface 🤦 instead of tackling the root cause. What do you think of the approach I took in this chain of commits?
bf48b59 -> 46b5ded -> aac56e0