Fix and verify Vue flow summaries

Author: Copilot

javascript/ql/lib/semmle/javascript/frameworks/Vue.qll

@@ -36,6 +36,7 @@ module Vue {
   }
 
   /** Models data flow through Vue Composition API helpers. */
+  overlay[local?]
   private class VueCompositionApiSummary extends DataFlow::SummarizedCallable::Range {
     string name;
 

javascript/ql/test/library-tests/frameworks/Vue/tests.expected

@@ -248,3 +248,13 @@ threatModelSource
 | single-file-component-6.vue:5:11:5:15 | input | view-component-input |
 | single-file-component-7.vue:5:11:5:15 | input | view-component-input |
 | single-file-component-8.vue:5:11:5:15 | input | view-component-input |
+compositionApiDataFlow
+| tst.js:119:14:119:26 | source("ref") | tst.js:119:6:119:33 | Vue.ref ... ).value |
+| tst.js:120:21:120:40 | source("shallowRef") | tst.js:120:6:120:47 | Vue.sha ... ).value |
+| tst.js:123:25:123:42 | source("computed") | tst.js:123:6:123:49 | Vue.com ... ).value |
+compositionApiTaintFlow
+| tst.js:119:14:119:26 | source("ref") | tst.js:119:6:119:33 | Vue.ref ... ).value |
+| tst.js:120:21:120:40 | source("shallowRef") | tst.js:120:6:120:47 | Vue.sha ... ).value |
+| tst.js:121:16:121:30 | source("toRef") | tst.js:121:6:121:37 | Vue.toR ... ).value |
+| tst.js:122:19:122:36 | source("reactive") | tst.js:122:6:122:37 | Vue.rea ... tive")) |
+| tst.js:123:25:123:42 | source("computed") | tst.js:123:6:123:49 | Vue.com ... ).value |