Merge pull request #14643 from aibaars/express-req-path

Javascript: add `req.path` as remote flow source

Author: erik-krogh

javascript/ql/lib/semmle/javascript/frameworks/Express.qll

@@ -618,6 +618,10 @@ module Express {
         or
         kind = "body" and
         this = ref.getAPropertyRead("body")
+        or
+        // `req.path`
+        kind = "url" and
+        this = ref.getAPropertyRead("path")
       )
     }
 

javascript/ql/test/library-tests/frameworks/Express/src/express.js

@@ -67,3 +67,9 @@ app.get('/some/non-xss1', function(req, res) {
   res.send(req.params.foo)
   foo(res);
 });
+
+app.get('/some/xss3', function(req, res) {
+  res.header("Content-Type", "text/html");
+  res.send(req.path)
+  foo(res);
+});