Call Passes More Arguments Than The Function Declares

ID

javascript.too_many_params_in_call

Severity

high

Remediation Complexity

trivial

Remediation Risk

low

Remediation Effort

low

Resource

Reliability

Language

JavaScript

Tags

best-practice, reliability, suspicious-comparison

Description

Reports a call that passes more arguments than the function it resolves to declares parameters:

function withdraw(account, amount) { /* ... */ }

withdraw(account, amount, "atm");   // the reason is silently dropped

Rationale

JavaScript discards the surplus without a word, so the call reads as if the extra value was passed and understood.

Every such call is one of two things, and both are defects:

  • An argument the caller believes is being used, and is not. The behaviour is simply missing, and there is nothing at the call site to say so.

  • A signature that lost a parameter while a caller was left behind. This is the common one: removing or reordering a parameter breaks nothing visible, so the stale call survives review and keeps running — now with its arguments shifted one place, which is the version of the bug that produces wrong results rather than missing ones.

Remediation

Decide which of the two it is:

  • If the value matters, add the parameter and use it.

  • If it does not, delete it from the call.

function withdraw(account, amount, reason) {
  audit(reason);
  return account.balance - amount;
}

withdraw(account, amount, "atm");

A function that genuinely takes a variable number of values should say so with a rest parameter, which also documents the intent:

function withdraw(account, amount, ...extras) { /* ... */ }

Notes

The rule reports only what can be answered without guessing:

  • Only a call written as a bare name, f(…​). A method call has a receiver whose type JavaScript does not state, so the callee is not identifiable.

  • Only a callee the file’s own scopes resolve to a function declaration — a function statement, or a binding initialised with a function or an arrow.

  • Not a function that declares a rest parameter or reads the arguments object: both accept any arity by design.

  • Not a call that spreads an argument, f(…​values), where how many arguments arrive is a runtime fact.

References

© 2026 Xygeni. All rights reserved