Eliminate redundant per-page-class join in isBracketedForTagHelperAttribute

The shared 'page' variable forced the evaluator to redundantly repeat
the expensive same-basic-block join once per RazorPageBase-derived
class (e.g. 525 classes in one real-world repo) instead of once per
distinct shared WriteLiteral/Begin/EndWriteTagHelperAttribute Method.
Resolving each call independently is semantically equivalent (the
per-instance correlation is already guaranteed by
hasImplicitThisQualifier() + same BasicBlock) and removes an
O(page-classes x calls) blowup that caused unbounded runtime on
Razor-heavy codebases.

Validated: direct DB runs against 3 real repos (before/after result
counts unchanged, cache-cleared A/B equivalence test), plus MRVA runs
on 2-core (45+min hang -> 4m22s) and 4-core (3m35s) GitHub Actions
runners for the same repo batch.

No change note: this predicate was introduced by this same unmerged
PR and has never shipped, so this is pre-release refinement, not a
behavior/perf fix to released code.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 463cbe9c-9db5-425f-8784-63ea319314b9

Author: felickz

csharp/ql/lib/semmle/code/csharp/security/dataflow/flowsinks/Html.qll

@@ -180,7 +180,7 @@ class MicrosoftAspNetCoreMvcHtmlHelperRawSink extends AspNetCoreHtmlSink {
 /**
  * Holds if `writeLiteral` is a call to `RazorPageBase.WriteLiteral` whose argument is captured
  * between a matching pair of `BeginWriteTagHelperAttribute()`/`EndWriteTagHelperAttribute()`
- * calls on `page`, in the same basic block, with no other such calls in between.
+ * calls, in the same basic block, with no other such calls in between.
  *
  * The Razor source generator emits this bracketing for every literal or expression segment of an
  * HTML attribute value on an element that also carries a tag helper (for example `asp-for`). Such
@@ -191,28 +191,39 @@ class MicrosoftAspNetCoreMvcHtmlHelperRawSink extends AspNetCoreHtmlSink {
  *
  * Because a basic block cannot contain a branch, requiring `beginCall`, `writeLiteral`, and
  * `endCall` to appear (in that order) in the same basic block, with no other
- * `Begin`/`EndWriteTagHelperAttribute` call from `page` strictly between `beginCall` and
- * `endCall`, guarantees that `beginCall`/`endCall` are the immediately enclosing bracket around
+ * `Begin`/`EndWriteTagHelperAttribute` call strictly between `beginCall` and `endCall`,
+ * guarantees that `beginCall`/`endCall` are the immediately enclosing bracket around
  * `writeLiteral` on every path that reaches it (that is, the bracket opened by `beginCall` is
  * still open, and not yet closed by some other `endCall`, at the point `writeLiteral` executes).
  * No other such call can coincide with `writeLiteral` itself, so checking the whole open interval
  * between `beginCall` and `endCall` is equivalent to checking it on both sides of `writeLiteral`
  * separately.
  *
  * `beginCall`, `writeLiteral`, and `endCall` are additionally required to have an implicit `this`
- * qualifier, which is how the Razor source generator always emits these calls. This ensures all
- * three calls act on the same page instance, so a bracket on one page cannot be mistaken for a
- * bracket around a `WriteLiteral` call on a different page.
+ * qualifier, which is how the Razor source generator always emits these calls. Combined with all
+ * three calls being required to lie in the same basic block (and hence the same method body),
+ * this ensures all three calls act on the same page instance, so a bracket on one page cannot be
+ * mistaken for a bracket around a `WriteLiteral` call on a different page.
+ *
+ * The `WriteLiteral`/`BeginWriteTagHelperAttribute`/`EndWriteTagHelperAttribute` methods are
+ * looked up via `any(MicrosoftAspNetCoreMvcRazorPageBase page).get...Method()` rather than
+ * through a single shared `page` variable bound across `writeLiteral`, `beginCall`, and
+ * `endCall`. These methods are inherited (not overridden) from the shared `RazorPageBase`
+ * framework type, so every generated Razor page class resolves to the same handful of `Method`
+ * entities; binding a single `page` variable across all three calls would force the join to be
+ * repeated once per generated page class in the codebase, rather than once per distinct `Method`,
+ * causing severe performance degradation on codebases with many Razor views.
  */
 private predicate isBracketedForTagHelperAttribute(Call writeLiteral) {
-  exists(
-    MicrosoftAspNetCoreMvcRazorPageBase page, MethodCall beginCall, MethodCall endCall,
-    BasicBlock bb, int i, int j, int k
-  |
+  exists(MethodCall beginCall, MethodCall endCall, BasicBlock bb, int i, int j, int k |
     bb = writeLiteral.getBasicBlock() and
-    writeLiteral = page.getWriteLiteralMethod().getACall() and
-    beginCall = page.getBeginWriteTagHelperAttributeMethod().getACall() and
-    endCall = page.getEndWriteTagHelperAttributeMethod().getACall() and
+    writeLiteral = any(MicrosoftAspNetCoreMvcRazorPageBase page).getWriteLiteralMethod().getACall() and
+    beginCall =
+      any(MicrosoftAspNetCoreMvcRazorPageBase page)
+          .getBeginWriteTagHelperAttributeMethod()
+          .getACall() and
+    endCall =
+      any(MicrosoftAspNetCoreMvcRazorPageBase page).getEndWriteTagHelperAttributeMethod().getACall() and
     writeLiteral.(QualifiableExpr).hasImplicitThisQualifier() and
     beginCall.hasImplicitThisQualifier() and
     endCall.hasImplicitThisQualifier() and
@@ -223,8 +234,14 @@ private predicate isBracketedForTagHelperAttribute(Call writeLiteral) {
     j < k and
     not exists(int l, Call other |
       (
-        other = page.getBeginWriteTagHelperAttributeMethod().getACall() or
-        other = page.getEndWriteTagHelperAttributeMethod().getACall()
+        other =
+          any(MicrosoftAspNetCoreMvcRazorPageBase page)
+              .getBeginWriteTagHelperAttributeMethod()
+              .getACall() or
+        other =
+          any(MicrosoftAspNetCoreMvcRazorPageBase page)
+              .getEndWriteTagHelperAttributeMethod()
+              .getACall()
       ) and
       bb.getNode(l) = other.getControlFlowNode() and
       i < l and