From ce11b5330d5dab3e3d8cc1d65d04e93e7d165ec6 Mon Sep 17 00:00:00 2001
From: Asger F <asger@semmle.com>
Date: Fri, 21 Sep 2018 18:37:03 +0100
Subject: [PATCH 1/4] JS: recognize Express headers as RequestInputAccess

---
 .../ql/src/semmle/javascript/frameworks/Express.qll   | 11 +++++++++++
 .../frameworks/Express/RequestInputAccess.expected    |  3 +++
 .../library-tests/frameworks/Express/src/express.js   |  6 ++++++
 3 files changed, 20 insertions(+)

diff --git a/javascript/ql/src/semmle/javascript/frameworks/Express.qll b/javascript/ql/src/semmle/javascript/frameworks/Express.qll
index c0163a143fe2..b2e1283e9073 100644
--- a/javascript/ql/src/semmle/javascript/frameworks/Express.qll
+++ b/javascript/ql/src/semmle/javascript/frameworks/Express.qll
@@ -479,6 +479,17 @@ module Express {
           methodName = "header"
         )
         or
+        exists (DataFlow::PropRead headers |
+          // `req.headers.name`
+          kind = "header" and
+          headers.accesses(request, "headers") and
+          this = headers.getAPropertyRead(_))
+        or
+        exists (string propName | propName = "host" or propName = "hostname" |
+          // `req.host` and `req.hostname` are derived from headers
+          kind = "header" and
+          this.(DataFlow::PropRead).accesses(request, propName))
+        or
         // `req.cookies`
         kind = "cookie" and
         this.(DataFlow::PropRef).accesses(request, "cookies")
diff --git a/javascript/ql/test/library-tests/frameworks/Express/RequestInputAccess.expected b/javascript/ql/test/library-tests/frameworks/Express/RequestInputAccess.expected
index ebfd4b31eeb5..8f759c8a1d5c 100644
--- a/javascript/ql/test/library-tests/frameworks/Express/RequestInputAccess.expected
+++ b/javascript/ql/test/library-tests/frameworks/Express/RequestInputAccess.expected
@@ -12,3 +12,6 @@
 | src/express.js:28:3:28:16 | req.get("foo") | header | src/express.js:22:30:32:1 | functio ... ar');\\n} |
 | src/express.js:29:3:29:19 | req.header("bar") | header | src/express.js:22:30:32:1 | functio ... ar');\\n} |
 | src/express.js:30:3:30:13 | req.cookies | cookie | src/express.js:22:30:32:1 | functio ... ar');\\n} |
+| src/express.js:47:3:47:17 | req.headers.baz | header | src/express.js:46:22:50:1 | functio ... name;\\n} |
+| src/express.js:48:3:48:10 | req.host | header | src/express.js:46:22:50:1 | functio ... name;\\n} |
+| src/express.js:49:3:49:14 | req.hostname | header | src/express.js:46:22:50:1 | functio ... name;\\n} |
diff --git a/javascript/ql/test/library-tests/frameworks/Express/src/express.js b/javascript/ql/test/library-tests/frameworks/Express/src/express.js
index ddbda24cd290..c3a96a3d6452 100644
--- a/javascript/ql/test/library-tests/frameworks/Express/src/express.js
+++ b/javascript/ql/test/library-tests/frameworks/Express/src/express.js
@@ -42,3 +42,9 @@ function getArrowHandler() {
     return (req, res) => f();
 }
 app.use(getArrowHandler());
+
+app.post('/headers', function(req, res) {
+  req.headers.baz;
+  req.host;
+  req.hostname;
+});

From e78a4e9f10b56f2ad771e7a5ce040bfca9bc9077 Mon Sep 17 00:00:00 2001
From: Asger F <asger@semmle.com>
Date: Fri, 21 Sep 2018 18:37:26 +0100
Subject: [PATCH 2/4] JS: update output from other Express tests

---
 .../frameworks/Express/RequestExpr.expected              | 3 +++
 .../frameworks/Express/RouteHandler.expected             | 1 +
 .../frameworks/Express/RouteHandlerExpr.expected         | 1 +
 .../RouteHandlerExpr_getAMatchingAncestor.expected       | 2 ++
 .../frameworks/Express/RouteHandlerExpr_getBody.expected | 1 +
 .../Express/RouteHandlerExpr_getNextMiddleware.expected  | 1 +
 .../RouteHandlerExpr_getPreviousMiddleware.expected      | 1 +
 .../Express/RouteHandler_getARequestExpr.expected        | 3 +++
 .../library-tests/frameworks/Express/RouteSetup.expected | 1 +
 .../Express/RouteSetup_getARouteHandler.expected         | 1 +
 .../Express/RouteSetup_getARouteHandlerExpr.expected     | 1 +
 .../Express/RouteSetup_getLastRouteHandlerExpr.expected  | 1 +
 .../Express/RouteSetup_getRequestMethod.expected         | 1 +
 .../Express/RouteSetup_getRouteHandlerExpr.expected      | 1 +
 .../frameworks/Express/RouteSetup_getRouter.expected     | 1 +
 .../frameworks/Express/RouteSetup_getServer.expected     | 1 +
 .../Express/RouterDefinition_getARouteHandler.expected   | 1 +
 .../RouterDefinition_getMiddlewareStackAt.expected       | 9 ++++++++-
 .../frameworks/Express/StandardRouteHandler.expected     | 1 +
 .../library-tests/frameworks/Express/isRequest.expected  | 3 +++
 20 files changed, 34 insertions(+), 1 deletion(-)

diff --git a/javascript/ql/test/library-tests/frameworks/Express/RequestExpr.expected b/javascript/ql/test/library-tests/frameworks/Express/RequestExpr.expected
index dab5febc8e86..8042100860d8 100644
--- a/javascript/ql/test/library-tests/frameworks/Express/RequestExpr.expected
+++ b/javascript/ql/test/library-tests/frameworks/Express/RequestExpr.expected
@@ -14,4 +14,7 @@
 | src/express.js:28:3:28:5 | req | src/express.js:22:30:32:1 | functio ... ar');\\n} |
 | src/express.js:29:3:29:5 | req | src/express.js:22:30:32:1 | functio ... ar');\\n} |
 | src/express.js:30:3:30:5 | req | src/express.js:22:30:32:1 | functio ... ar');\\n} |
+| src/express.js:47:3:47:5 | req | src/express.js:46:22:50:1 | functio ... name;\\n} |
+| src/express.js:48:3:48:5 | req | src/express.js:46:22:50:1 | functio ... name;\\n} |
+| src/express.js:49:3:49:5 | req | src/express.js:46:22:50:1 | functio ... name;\\n} |
 | src/responseExprs.js:17:5:17:7 | req | src/responseExprs.js:16:30:42:1 | functio ...     }\\n} |
diff --git a/javascript/ql/test/library-tests/frameworks/Express/RouteHandler.expected b/javascript/ql/test/library-tests/frameworks/Express/RouteHandler.expected
index 2751fe2b1618..16d1cfbe68dd 100644
--- a/javascript/ql/test/library-tests/frameworks/Express/RouteHandler.expected
+++ b/javascript/ql/test/library-tests/frameworks/Express/RouteHandler.expected
@@ -14,6 +14,7 @@
 | src/express.js:22:30:32:1 | functio ... ar');\\n} | src/express.js:22:39:22:41 | req | src/express.js:22:44:22:46 | res |
 | src/express.js:37:12:37:32 | functio ...  res){} | src/express.js:37:22:37:24 | req | src/express.js:37:27:37:29 | res |
 | src/express.js:42:12:42:28 | (req, res) => f() | src/express.js:42:13:42:15 | req | src/express.js:42:18:42:20 | res |
+| src/express.js:46:22:50:1 | functio ... name;\\n} | src/express.js:46:31:46:33 | req | src/express.js:46:36:46:38 | res |
 | src/responseExprs.js:4:23:6:1 | functio ...  res1\\n} | src/responseExprs.js:4:32:4:34 | req | src/responseExprs.js:4:37:4:40 | res1 |
 | src/responseExprs.js:7:23:9:1 | functio ... res2;\\n} | src/responseExprs.js:7:32:7:34 | req | src/responseExprs.js:7:37:7:40 | res2 |
 | src/responseExprs.js:10:23:12:1 | functio ... res3;\\n} | src/responseExprs.js:10:39:10:41 | req | src/responseExprs.js:10:44:10:47 | res3 |
diff --git a/javascript/ql/test/library-tests/frameworks/Express/RouteHandlerExpr.expected b/javascript/ql/test/library-tests/frameworks/Express/RouteHandlerExpr.expected
index aaf31f20eebd..ea23e2485942 100644
--- a/javascript/ql/test/library-tests/frameworks/Express/RouteHandlerExpr.expected
+++ b/javascript/ql/test/library-tests/frameworks/Express/RouteHandlerExpr.expected
@@ -20,6 +20,7 @@
 | src/express.js:34:14:34:52 | require ... handler | src/express.js:34:1:34:53 | app.get ... andler) | true |
 | src/express.js:39:9:39:20 | getHandler() | src/express.js:39:1:39:21 | app.use ... dler()) | false |
 | src/express.js:44:9:44:25 | getArrowHandler() | src/express.js:44:1:44:26 | app.use ... dler()) | false |
+| src/express.js:46:22:50:1 | functio ... name;\\n} | src/express.js:46:1:50:2 | app.pos ... ame;\\n}) | true |
 | src/responseExprs.js:4:23:6:1 | functio ...  res1\\n} | src/responseExprs.js:4:1:6:2 | app.get ... res1\\n}) | true |
 | src/responseExprs.js:7:23:9:1 | functio ... res2;\\n} | src/responseExprs.js:7:1:9:2 | app.get ... es2;\\n}) | true |
 | src/responseExprs.js:10:23:12:1 | functio ... res3;\\n} | src/responseExprs.js:10:1:12:2 | app.get ... es3;\\n}) | true |
diff --git a/javascript/ql/test/library-tests/frameworks/Express/RouteHandlerExpr_getAMatchingAncestor.expected b/javascript/ql/test/library-tests/frameworks/Express/RouteHandlerExpr_getAMatchingAncestor.expected
index d66b0b4915a7..3f48873daa7b 100644
--- a/javascript/ql/test/library-tests/frameworks/Express/RouteHandlerExpr_getAMatchingAncestor.expected
+++ b/javascript/ql/test/library-tests/frameworks/Express/RouteHandlerExpr_getAMatchingAncestor.expected
@@ -16,3 +16,5 @@
 | src/express.js:16:19:18:3 | functio ... ");\\n  } | src/express.js:39:9:39:20 | getHandler() |
 | src/express.js:16:19:18:3 | functio ... ");\\n  } | src/express.js:44:9:44:25 | getArrowHandler() |
 | src/express.js:44:9:44:25 | getArrowHandler() | src/express.js:39:9:39:20 | getHandler() |
+| src/express.js:46:22:50:1 | functio ... name;\\n} | src/express.js:39:9:39:20 | getHandler() |
+| src/express.js:46:22:50:1 | functio ... name;\\n} | src/express.js:44:9:44:25 | getArrowHandler() |
diff --git a/javascript/ql/test/library-tests/frameworks/Express/RouteHandlerExpr_getBody.expected b/javascript/ql/test/library-tests/frameworks/Express/RouteHandlerExpr_getBody.expected
index 2a46b11b1d7e..2c79ac135a61 100644
--- a/javascript/ql/test/library-tests/frameworks/Express/RouteHandlerExpr_getBody.expected
+++ b/javascript/ql/test/library-tests/frameworks/Express/RouteHandlerExpr_getBody.expected
@@ -10,6 +10,7 @@
 | src/express.js:4:23:9:1 | functio ... res);\\n} | src/express.js:4:23:9:1 | functio ... res);\\n} |
 | src/express.js:16:19:18:3 | functio ... ");\\n  } | src/express.js:16:19:18:3 | functio ... ");\\n  } |
 | src/express.js:22:30:32:1 | functio ... ar');\\n} | src/express.js:22:30:32:1 | functio ... ar');\\n} |
+| src/express.js:46:22:50:1 | functio ... name;\\n} | src/express.js:46:22:50:1 | functio ... name;\\n} |
 | src/responseExprs.js:4:23:6:1 | functio ...  res1\\n} | src/responseExprs.js:4:23:6:1 | functio ...  res1\\n} |
 | src/responseExprs.js:7:23:9:1 | functio ... res2;\\n} | src/responseExprs.js:7:23:9:1 | functio ... res2;\\n} |
 | src/responseExprs.js:10:23:12:1 | functio ... res3;\\n} | src/responseExprs.js:10:23:12:1 | functio ... res3;\\n} |
diff --git a/javascript/ql/test/library-tests/frameworks/Express/RouteHandlerExpr_getNextMiddleware.expected b/javascript/ql/test/library-tests/frameworks/Express/RouteHandlerExpr_getNextMiddleware.expected
index 893037fd8083..8aa06c0a8d6d 100644
--- a/javascript/ql/test/library-tests/frameworks/Express/RouteHandlerExpr_getNextMiddleware.expected
+++ b/javascript/ql/test/library-tests/frameworks/Express/RouteHandlerExpr_getNextMiddleware.expected
@@ -7,4 +7,5 @@
 | src/csurf-example.js:18:9:18:30 | csrf({  ... true }) | src/csurf-example.js:40:27:40:48 | functio ... res) {} |
 | src/express.js:39:9:39:20 | getHandler() | src/express.js:44:9:44:25 | getArrowHandler() |
 | src/express.js:44:9:44:25 | getArrowHandler() | src/express.js:16:19:18:3 | functio ... ");\\n  } |
+| src/express.js:44:9:44:25 | getArrowHandler() | src/express.js:46:22:50:1 | functio ... name;\\n} |
 | src/subrouter.js:4:19:4:25 | protect | src/subrouter.js:5:14:5:28 | makeSubRouter() |
diff --git a/javascript/ql/test/library-tests/frameworks/Express/RouteHandlerExpr_getPreviousMiddleware.expected b/javascript/ql/test/library-tests/frameworks/Express/RouteHandlerExpr_getPreviousMiddleware.expected
index a58a2cfa0ddc..c1f2223bf3e8 100644
--- a/javascript/ql/test/library-tests/frameworks/Express/RouteHandlerExpr_getPreviousMiddleware.expected
+++ b/javascript/ql/test/library-tests/frameworks/Express/RouteHandlerExpr_getPreviousMiddleware.expected
@@ -7,4 +7,5 @@
 | src/csurf-example.js:40:27:40:48 | functio ... res) {} | src/csurf-example.js:18:9:18:30 | csrf({  ... true }) |
 | src/express.js:16:19:18:3 | functio ... ");\\n  } | src/express.js:44:9:44:25 | getArrowHandler() |
 | src/express.js:44:9:44:25 | getArrowHandler() | src/express.js:39:9:39:20 | getHandler() |
+| src/express.js:46:22:50:1 | functio ... name;\\n} | src/express.js:44:9:44:25 | getArrowHandler() |
 | src/subrouter.js:5:14:5:28 | makeSubRouter() | src/subrouter.js:4:19:4:25 | protect |
diff --git a/javascript/ql/test/library-tests/frameworks/Express/RouteHandler_getARequestExpr.expected b/javascript/ql/test/library-tests/frameworks/Express/RouteHandler_getARequestExpr.expected
index f495f1c550a4..23d8c7ee264f 100644
--- a/javascript/ql/test/library-tests/frameworks/Express/RouteHandler_getARequestExpr.expected
+++ b/javascript/ql/test/library-tests/frameworks/Express/RouteHandler_getARequestExpr.expected
@@ -14,4 +14,7 @@
 | src/express.js:22:30:32:1 | functio ... ar');\\n} | src/express.js:28:3:28:5 | req |
 | src/express.js:22:30:32:1 | functio ... ar');\\n} | src/express.js:29:3:29:5 | req |
 | src/express.js:22:30:32:1 | functio ... ar');\\n} | src/express.js:30:3:30:5 | req |
+| src/express.js:46:22:50:1 | functio ... name;\\n} | src/express.js:47:3:47:5 | req |
+| src/express.js:46:22:50:1 | functio ... name;\\n} | src/express.js:48:3:48:5 | req |
+| src/express.js:46:22:50:1 | functio ... name;\\n} | src/express.js:49:3:49:5 | req |
 | src/responseExprs.js:16:30:42:1 | functio ...     }\\n} | src/responseExprs.js:17:5:17:7 | req |
diff --git a/javascript/ql/test/library-tests/frameworks/Express/RouteSetup.expected b/javascript/ql/test/library-tests/frameworks/Express/RouteSetup.expected
index 0489f326ba1f..e59183f81608 100644
--- a/javascript/ql/test/library-tests/frameworks/Express/RouteSetup.expected
+++ b/javascript/ql/test/library-tests/frameworks/Express/RouteSetup.expected
@@ -9,6 +9,7 @@
 | src/express.js:4:1:9:2 | app.get ... es);\\n}) | src/express.js:2:11:2:19 | express() | false |
 | src/express.js:16:3:18:4 | router. ... );\\n  }) | src/express.js:2:11:2:19 | express() | false |
 | src/express.js:22:1:32:2 | app.pos ... r');\\n}) | src/express.js:2:11:2:19 | express() | false |
+| src/express.js:46:1:50:2 | app.pos ... ame;\\n}) | src/express.js:2:11:2:19 | express() | false |
 | src/responseExprs.js:4:1:6:2 | app.get ... res1\\n}) | src/responseExprs.js:2:11:2:19 | express() | false |
 | src/responseExprs.js:7:1:9:2 | app.get ... es2;\\n}) | src/responseExprs.js:2:11:2:19 | express() | false |
 | src/responseExprs.js:10:1:12:2 | app.get ... es3;\\n}) | src/responseExprs.js:2:11:2:19 | express() | false |
diff --git a/javascript/ql/test/library-tests/frameworks/Express/RouteSetup_getARouteHandler.expected b/javascript/ql/test/library-tests/frameworks/Express/RouteSetup_getARouteHandler.expected
index ce4218b05a86..4352f83b53c7 100644
--- a/javascript/ql/test/library-tests/frameworks/Express/RouteSetup_getARouteHandler.expected
+++ b/javascript/ql/test/library-tests/frameworks/Express/RouteSetup_getARouteHandler.expected
@@ -25,6 +25,7 @@
 | src/express.js:39:1:39:21 | app.use ... dler()) | src/express.js:39:9:39:20 | getHandler() |
 | src/express.js:44:1:44:26 | app.use ... dler()) | src/express.js:42:12:42:28 | (req, res) => f() |
 | src/express.js:44:1:44:26 | app.use ... dler()) | src/express.js:44:9:44:25 | getArrowHandler() |
+| src/express.js:46:1:50:2 | app.pos ... ame;\\n}) | src/express.js:46:22:50:1 | functio ... name;\\n} |
 | src/responseExprs.js:4:1:6:2 | app.get ... res1\\n}) | src/responseExprs.js:4:23:6:1 | functio ...  res1\\n} |
 | src/responseExprs.js:7:1:9:2 | app.get ... es2;\\n}) | src/responseExprs.js:7:23:9:1 | functio ... res2;\\n} |
 | src/responseExprs.js:10:1:12:2 | app.get ... es3;\\n}) | src/responseExprs.js:10:23:12:1 | functio ... res3;\\n} |
diff --git a/javascript/ql/test/library-tests/frameworks/Express/RouteSetup_getARouteHandlerExpr.expected b/javascript/ql/test/library-tests/frameworks/Express/RouteSetup_getARouteHandlerExpr.expected
index 8f3eefb0ef42..d350d2943717 100644
--- a/javascript/ql/test/library-tests/frameworks/Express/RouteSetup_getARouteHandlerExpr.expected
+++ b/javascript/ql/test/library-tests/frameworks/Express/RouteSetup_getARouteHandlerExpr.expected
@@ -20,6 +20,7 @@
 | src/express.js:34:1:34:53 | app.get ... andler) | src/express.js:34:14:34:52 | require ... handler |
 | src/express.js:39:1:39:21 | app.use ... dler()) | src/express.js:39:9:39:20 | getHandler() |
 | src/express.js:44:1:44:26 | app.use ... dler()) | src/express.js:44:9:44:25 | getArrowHandler() |
+| src/express.js:46:1:50:2 | app.pos ... ame;\\n}) | src/express.js:46:22:50:1 | functio ... name;\\n} |
 | src/responseExprs.js:4:1:6:2 | app.get ... res1\\n}) | src/responseExprs.js:4:23:6:1 | functio ...  res1\\n} |
 | src/responseExprs.js:7:1:9:2 | app.get ... es2;\\n}) | src/responseExprs.js:7:23:9:1 | functio ... res2;\\n} |
 | src/responseExprs.js:10:1:12:2 | app.get ... es3;\\n}) | src/responseExprs.js:10:23:12:1 | functio ... res3;\\n} |
diff --git a/javascript/ql/test/library-tests/frameworks/Express/RouteSetup_getLastRouteHandlerExpr.expected b/javascript/ql/test/library-tests/frameworks/Express/RouteSetup_getLastRouteHandlerExpr.expected
index 8f3eefb0ef42..d350d2943717 100644
--- a/javascript/ql/test/library-tests/frameworks/Express/RouteSetup_getLastRouteHandlerExpr.expected
+++ b/javascript/ql/test/library-tests/frameworks/Express/RouteSetup_getLastRouteHandlerExpr.expected
@@ -20,6 +20,7 @@
 | src/express.js:34:1:34:53 | app.get ... andler) | src/express.js:34:14:34:52 | require ... handler |
 | src/express.js:39:1:39:21 | app.use ... dler()) | src/express.js:39:9:39:20 | getHandler() |
 | src/express.js:44:1:44:26 | app.use ... dler()) | src/express.js:44:9:44:25 | getArrowHandler() |
+| src/express.js:46:1:50:2 | app.pos ... ame;\\n}) | src/express.js:46:22:50:1 | functio ... name;\\n} |
 | src/responseExprs.js:4:1:6:2 | app.get ... res1\\n}) | src/responseExprs.js:4:23:6:1 | functio ...  res1\\n} |
 | src/responseExprs.js:7:1:9:2 | app.get ... es2;\\n}) | src/responseExprs.js:7:23:9:1 | functio ... res2;\\n} |
 | src/responseExprs.js:10:1:12:2 | app.get ... es3;\\n}) | src/responseExprs.js:10:23:12:1 | functio ... res3;\\n} |
diff --git a/javascript/ql/test/library-tests/frameworks/Express/RouteSetup_getRequestMethod.expected b/javascript/ql/test/library-tests/frameworks/Express/RouteSetup_getRequestMethod.expected
index ff71b7d13f5e..be97e5c4a592 100644
--- a/javascript/ql/test/library-tests/frameworks/Express/RouteSetup_getRequestMethod.expected
+++ b/javascript/ql/test/library-tests/frameworks/Express/RouteSetup_getRequestMethod.expected
@@ -11,6 +11,7 @@
 | src/express.js:16:3:18:4 | router. ... );\\n  }) | GET |
 | src/express.js:22:1:32:2 | app.pos ... r');\\n}) | POST |
 | src/express.js:34:1:34:53 | app.get ... andler) | GET |
+| src/express.js:46:1:50:2 | app.pos ... ame;\\n}) | POST |
 | src/responseExprs.js:4:1:6:2 | app.get ... res1\\n}) | GET |
 | src/responseExprs.js:7:1:9:2 | app.get ... es2;\\n}) | GET |
 | src/responseExprs.js:10:1:12:2 | app.get ... es3;\\n}) | GET |
diff --git a/javascript/ql/test/library-tests/frameworks/Express/RouteSetup_getRouteHandlerExpr.expected b/javascript/ql/test/library-tests/frameworks/Express/RouteSetup_getRouteHandlerExpr.expected
index 226a3d59d097..215340c51df3 100644
--- a/javascript/ql/test/library-tests/frameworks/Express/RouteSetup_getRouteHandlerExpr.expected
+++ b/javascript/ql/test/library-tests/frameworks/Express/RouteSetup_getRouteHandlerExpr.expected
@@ -20,6 +20,7 @@
 | src/express.js:34:1:34:53 | app.get ... andler) | 0 | src/express.js:34:14:34:52 | require ... handler |
 | src/express.js:39:1:39:21 | app.use ... dler()) | 0 | src/express.js:39:9:39:20 | getHandler() |
 | src/express.js:44:1:44:26 | app.use ... dler()) | 0 | src/express.js:44:9:44:25 | getArrowHandler() |
+| src/express.js:46:1:50:2 | app.pos ... ame;\\n}) | 0 | src/express.js:46:22:50:1 | functio ... name;\\n} |
 | src/responseExprs.js:4:1:6:2 | app.get ... res1\\n}) | 0 | src/responseExprs.js:4:23:6:1 | functio ...  res1\\n} |
 | src/responseExprs.js:7:1:9:2 | app.get ... es2;\\n}) | 0 | src/responseExprs.js:7:23:9:1 | functio ... res2;\\n} |
 | src/responseExprs.js:10:1:12:2 | app.get ... es3;\\n}) | 0 | src/responseExprs.js:10:23:12:1 | functio ... res3;\\n} |
diff --git a/javascript/ql/test/library-tests/frameworks/Express/RouteSetup_getRouter.expected b/javascript/ql/test/library-tests/frameworks/Express/RouteSetup_getRouter.expected
index c29595cc07b9..dfeaa9922949 100644
--- a/javascript/ql/test/library-tests/frameworks/Express/RouteSetup_getRouter.expected
+++ b/javascript/ql/test/library-tests/frameworks/Express/RouteSetup_getRouter.expected
@@ -20,6 +20,7 @@
 | src/express.js:34:1:34:53 | app.get ... andler) | src/express.js:2:11:2:19 | express() |
 | src/express.js:39:1:39:21 | app.use ... dler()) | src/express.js:2:11:2:19 | express() |
 | src/express.js:44:1:44:26 | app.use ... dler()) | src/express.js:2:11:2:19 | express() |
+| src/express.js:46:1:50:2 | app.pos ... ame;\\n}) | src/express.js:2:11:2:19 | express() |
 | src/responseExprs.js:4:1:6:2 | app.get ... res1\\n}) | src/responseExprs.js:2:11:2:19 | express() |
 | src/responseExprs.js:7:1:9:2 | app.get ... es2;\\n}) | src/responseExprs.js:2:11:2:19 | express() |
 | src/responseExprs.js:10:1:12:2 | app.get ... es3;\\n}) | src/responseExprs.js:2:11:2:19 | express() |
diff --git a/javascript/ql/test/library-tests/frameworks/Express/RouteSetup_getServer.expected b/javascript/ql/test/library-tests/frameworks/Express/RouteSetup_getServer.expected
index 68bcc0d9b677..23da8a6bdaa1 100644
--- a/javascript/ql/test/library-tests/frameworks/Express/RouteSetup_getServer.expected
+++ b/javascript/ql/test/library-tests/frameworks/Express/RouteSetup_getServer.expected
@@ -9,6 +9,7 @@
 | src/express.js:4:1:9:2 | app.get ... es);\\n}) | src/express.js:2:11:2:19 | express() |
 | src/express.js:16:3:18:4 | router. ... );\\n  }) | src/express.js:2:11:2:19 | express() |
 | src/express.js:22:1:32:2 | app.pos ... r');\\n}) | src/express.js:2:11:2:19 | express() |
+| src/express.js:46:1:50:2 | app.pos ... ame;\\n}) | src/express.js:2:11:2:19 | express() |
 | src/responseExprs.js:4:1:6:2 | app.get ... res1\\n}) | src/responseExprs.js:2:11:2:19 | express() |
 | src/responseExprs.js:7:1:9:2 | app.get ... es2;\\n}) | src/responseExprs.js:2:11:2:19 | express() |
 | src/responseExprs.js:10:1:12:2 | app.get ... es3;\\n}) | src/responseExprs.js:2:11:2:19 | express() |
diff --git a/javascript/ql/test/library-tests/frameworks/Express/RouterDefinition_getARouteHandler.expected b/javascript/ql/test/library-tests/frameworks/Express/RouterDefinition_getARouteHandler.expected
index 9ff5a646dd54..e10a8c517121 100644
--- a/javascript/ql/test/library-tests/frameworks/Express/RouterDefinition_getARouteHandler.expected
+++ b/javascript/ql/test/library-tests/frameworks/Express/RouterDefinition_getARouteHandler.expected
@@ -9,6 +9,7 @@
 | src/express.js:2:11:2:19 | express() | src/express.js:4:23:9:1 | functio ... res);\\n} |
 | src/express.js:2:11:2:19 | express() | src/express.js:16:19:18:3 | functio ... ");\\n  } |
 | src/express.js:2:11:2:19 | express() | src/express.js:22:30:32:1 | functio ... ar');\\n} |
+| src/express.js:2:11:2:19 | express() | src/express.js:46:22:50:1 | functio ... name;\\n} |
 | src/responseExprs.js:2:11:2:19 | express() | src/responseExprs.js:4:23:6:1 | functio ...  res1\\n} |
 | src/responseExprs.js:2:11:2:19 | express() | src/responseExprs.js:7:23:9:1 | functio ... res2;\\n} |
 | src/responseExprs.js:2:11:2:19 | express() | src/responseExprs.js:10:23:12:1 | functio ... res3;\\n} |
diff --git a/javascript/ql/test/library-tests/frameworks/Express/RouterDefinition_getMiddlewareStackAt.expected b/javascript/ql/test/library-tests/frameworks/Express/RouterDefinition_getMiddlewareStackAt.expected
index 232ca3a54f9d..0db82edd5d4c 100644
--- a/javascript/ql/test/library-tests/frameworks/Express/RouterDefinition_getMiddlewareStackAt.expected
+++ b/javascript/ql/test/library-tests/frameworks/Express/RouterDefinition_getMiddlewareStackAt.expected
@@ -75,7 +75,14 @@
 | src/express.js:2:11:2:19 | express() | src/express.js:44:5:44:7 | use | src/express.js:39:9:39:20 | getHandler() |
 | src/express.js:2:11:2:19 | express() | src/express.js:44:9:44:23 | getArrowHandler | src/express.js:39:9:39:20 | getHandler() |
 | src/express.js:2:11:2:19 | express() | src/express.js:44:9:44:25 | getArrowHandler() | src/express.js:39:9:39:20 | getHandler() |
-| src/express.js:2:11:2:19 | express() | src/express.js:45:1:45:0 | exit node of <toplevel> | src/express.js:44:9:44:25 | getArrowHandler() |
+| src/express.js:2:11:2:19 | express() | src/express.js:46:1:46:3 | app | src/express.js:44:9:44:25 | getArrowHandler() |
+| src/express.js:2:11:2:19 | express() | src/express.js:46:1:46:8 | app.post | src/express.js:44:9:44:25 | getArrowHandler() |
+| src/express.js:2:11:2:19 | express() | src/express.js:46:1:50:2 | app.pos ... ame;\\n}) | src/express.js:44:9:44:25 | getArrowHandler() |
+| src/express.js:2:11:2:19 | express() | src/express.js:46:1:50:3 | app.pos ... me;\\n}); | src/express.js:44:9:44:25 | getArrowHandler() |
+| src/express.js:2:11:2:19 | express() | src/express.js:46:5:46:8 | post | src/express.js:44:9:44:25 | getArrowHandler() |
+| src/express.js:2:11:2:19 | express() | src/express.js:46:10:46:19 | '/headers' | src/express.js:44:9:44:25 | getArrowHandler() |
+| src/express.js:2:11:2:19 | express() | src/express.js:46:22:50:1 | functio ... name;\\n} | src/express.js:44:9:44:25 | getArrowHandler() |
+| src/express.js:2:11:2:19 | express() | src/express.js:51:1:51:0 | exit node of <toplevel> | src/express.js:44:9:44:25 | getArrowHandler() |
 | src/subrouter.js:2:11:2:19 | express() | src/subrouter.js:4:1:4:26 | app.use ... rotect) | src/subrouter.js:4:19:4:25 | protect |
 | src/subrouter.js:2:11:2:19 | express() | src/subrouter.js:5:1:5:3 | app | src/subrouter.js:4:19:4:25 | protect |
 | src/subrouter.js:2:11:2:19 | express() | src/subrouter.js:5:1:5:7 | app.use | src/subrouter.js:4:19:4:25 | protect |
diff --git a/javascript/ql/test/library-tests/frameworks/Express/StandardRouteHandler.expected b/javascript/ql/test/library-tests/frameworks/Express/StandardRouteHandler.expected
index e3cbcce77aaa..a6d30697915d 100644
--- a/javascript/ql/test/library-tests/frameworks/Express/StandardRouteHandler.expected
+++ b/javascript/ql/test/library-tests/frameworks/Express/StandardRouteHandler.expected
@@ -9,6 +9,7 @@
 | src/express.js:4:23:9:1 | functio ... res);\\n} | src/express.js:2:11:2:19 | express() | src/express.js:4:32:4:34 | req | src/express.js:4:37:4:39 | res |
 | src/express.js:16:19:18:3 | functio ... ");\\n  } | src/express.js:2:11:2:19 | express() | src/express.js:16:28:16:30 | req | src/express.js:16:33:16:35 | res |
 | src/express.js:22:30:32:1 | functio ... ar');\\n} | src/express.js:2:11:2:19 | express() | src/express.js:22:39:22:41 | req | src/express.js:22:44:22:46 | res |
+| src/express.js:46:22:50:1 | functio ... name;\\n} | src/express.js:2:11:2:19 | express() | src/express.js:46:31:46:33 | req | src/express.js:46:36:46:38 | res |
 | src/responseExprs.js:4:23:6:1 | functio ...  res1\\n} | src/responseExprs.js:2:11:2:19 | express() | src/responseExprs.js:4:32:4:34 | req | src/responseExprs.js:4:37:4:40 | res1 |
 | src/responseExprs.js:7:23:9:1 | functio ... res2;\\n} | src/responseExprs.js:2:11:2:19 | express() | src/responseExprs.js:7:32:7:34 | req | src/responseExprs.js:7:37:7:40 | res2 |
 | src/responseExprs.js:10:23:12:1 | functio ... res3;\\n} | src/responseExprs.js:2:11:2:19 | express() | src/responseExprs.js:10:39:10:41 | req | src/responseExprs.js:10:44:10:47 | res3 |
diff --git a/javascript/ql/test/library-tests/frameworks/Express/isRequest.expected b/javascript/ql/test/library-tests/frameworks/Express/isRequest.expected
index 34e47ad1c92c..5b2915b2b384 100644
--- a/javascript/ql/test/library-tests/frameworks/Express/isRequest.expected
+++ b/javascript/ql/test/library-tests/frameworks/Express/isRequest.expected
@@ -14,4 +14,7 @@
 | src/express.js:28:3:28:5 | req |
 | src/express.js:29:3:29:5 | req |
 | src/express.js:30:3:30:5 | req |
+| src/express.js:47:3:47:5 | req |
+| src/express.js:48:3:48:5 | req |
+| src/express.js:49:3:49:5 | req |
 | src/responseExprs.js:17:5:17:7 | req |

From a47b1dc774579e98bddecd5c5abb7fc28e06276f Mon Sep 17 00:00:00 2001
From: Asger F <asger@semmle.com>
Date: Wed, 26 Sep 2018 08:22:21 +0100
Subject: [PATCH 3/4] JS: recognize Express header access with dynamic name

---
 javascript/ql/src/semmle/javascript/frameworks/Express.qll | 2 +-
 .../frameworks/Express/RequestInputAccess.expected         | 7 ++++---
 .../test/library-tests/frameworks/Express/src/express.js   | 1 +
 3 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/javascript/ql/src/semmle/javascript/frameworks/Express.qll b/javascript/ql/src/semmle/javascript/frameworks/Express.qll
index b2e1283e9073..03bdfbbf52f2 100644
--- a/javascript/ql/src/semmle/javascript/frameworks/Express.qll
+++ b/javascript/ql/src/semmle/javascript/frameworks/Express.qll
@@ -483,7 +483,7 @@ module Express {
           // `req.headers.name`
           kind = "header" and
           headers.accesses(request, "headers") and
-          this = headers.getAPropertyRead(_))
+          this = headers.getAPropertyRead())
         or
         exists (string propName | propName = "host" or propName = "hostname" |
           // `req.host` and `req.hostname` are derived from headers
diff --git a/javascript/ql/test/library-tests/frameworks/Express/RequestInputAccess.expected b/javascript/ql/test/library-tests/frameworks/Express/RequestInputAccess.expected
index 8f759c8a1d5c..8c0b0b3b76c3 100644
--- a/javascript/ql/test/library-tests/frameworks/Express/RequestInputAccess.expected
+++ b/javascript/ql/test/library-tests/frameworks/Express/RequestInputAccess.expected
@@ -12,6 +12,7 @@
 | src/express.js:28:3:28:16 | req.get("foo") | header | src/express.js:22:30:32:1 | functio ... ar');\\n} |
 | src/express.js:29:3:29:19 | req.header("bar") | header | src/express.js:22:30:32:1 | functio ... ar');\\n} |
 | src/express.js:30:3:30:13 | req.cookies | cookie | src/express.js:22:30:32:1 | functio ... ar');\\n} |
-| src/express.js:47:3:47:17 | req.headers.baz | header | src/express.js:46:22:50:1 | functio ... name;\\n} |
-| src/express.js:48:3:48:10 | req.host | header | src/express.js:46:22:50:1 | functio ... name;\\n} |
-| src/express.js:49:3:49:14 | req.hostname | header | src/express.js:46:22:50:1 | functio ... name;\\n} |
+| src/express.js:47:3:47:17 | req.headers.baz | header | src/express.js:46:22:51:1 | functio ... ame];\\n} |
+| src/express.js:48:3:48:10 | req.host | header | src/express.js:46:22:51:1 | functio ... ame];\\n} |
+| src/express.js:49:3:49:14 | req.hostname | header | src/express.js:46:22:51:1 | functio ... ame];\\n} |
+| src/express.js:50:3:50:32 | req.hea ... erName] | header | src/express.js:46:22:51:1 | functio ... ame];\\n} |
diff --git a/javascript/ql/test/library-tests/frameworks/Express/src/express.js b/javascript/ql/test/library-tests/frameworks/Express/src/express.js
index c3a96a3d6452..d60a18cde4fb 100644
--- a/javascript/ql/test/library-tests/frameworks/Express/src/express.js
+++ b/javascript/ql/test/library-tests/frameworks/Express/src/express.js
@@ -47,4 +47,5 @@ app.post('/headers', function(req, res) {
   req.headers.baz;
   req.host;
   req.hostname;
+  req.headers[config.headerName];
 });

From 057c3a92b4b04775741d8565acdf9747ee259730 Mon Sep 17 00:00:00 2001
From: Asger F <asger@semmle.com>
Date: Wed, 26 Sep 2018 08:36:52 +0100
Subject: [PATCH 4/4] JS: update other Express test outputs

---
 .../library-tests/frameworks/Express/RequestExpr.expected | 7 ++++---
 .../frameworks/Express/RouteHandler.expected              | 2 +-
 .../frameworks/Express/RouteHandlerExpr.expected          | 2 +-
 .../RouteHandlerExpr_getAMatchingAncestor.expected        | 4 ++--
 .../frameworks/Express/RouteHandlerExpr_getBody.expected  | 2 +-
 .../Express/RouteHandlerExpr_getNextMiddleware.expected   | 2 +-
 .../RouteHandlerExpr_getPreviousMiddleware.expected       | 2 +-
 .../Express/RouteHandler_getARequestExpr.expected         | 7 ++++---
 .../library-tests/frameworks/Express/RouteSetup.expected  | 2 +-
 .../Express/RouteSetup_getARouteHandler.expected          | 2 +-
 .../Express/RouteSetup_getARouteHandlerExpr.expected      | 2 +-
 .../Express/RouteSetup_getLastRouteHandlerExpr.expected   | 2 +-
 .../Express/RouteSetup_getRequestMethod.expected          | 2 +-
 .../Express/RouteSetup_getRouteHandlerExpr.expected       | 2 +-
 .../frameworks/Express/RouteSetup_getRouter.expected      | 2 +-
 .../frameworks/Express/RouteSetup_getServer.expected      | 2 +-
 .../Express/RouterDefinition_getARouteHandler.expected    | 2 +-
 .../RouterDefinition_getMiddlewareStackAt.expected        | 8 ++++----
 .../frameworks/Express/StandardRouteHandler.expected      | 2 +-
 .../library-tests/frameworks/Express/isRequest.expected   | 1 +
 20 files changed, 30 insertions(+), 27 deletions(-)

diff --git a/javascript/ql/test/library-tests/frameworks/Express/RequestExpr.expected b/javascript/ql/test/library-tests/frameworks/Express/RequestExpr.expected
index 8042100860d8..6425c04ab80d 100644
--- a/javascript/ql/test/library-tests/frameworks/Express/RequestExpr.expected
+++ b/javascript/ql/test/library-tests/frameworks/Express/RequestExpr.expected
@@ -14,7 +14,8 @@
 | src/express.js:28:3:28:5 | req | src/express.js:22:30:32:1 | functio ... ar');\\n} |
 | src/express.js:29:3:29:5 | req | src/express.js:22:30:32:1 | functio ... ar');\\n} |
 | src/express.js:30:3:30:5 | req | src/express.js:22:30:32:1 | functio ... ar');\\n} |
-| src/express.js:47:3:47:5 | req | src/express.js:46:22:50:1 | functio ... name;\\n} |
-| src/express.js:48:3:48:5 | req | src/express.js:46:22:50:1 | functio ... name;\\n} |
-| src/express.js:49:3:49:5 | req | src/express.js:46:22:50:1 | functio ... name;\\n} |
+| src/express.js:47:3:47:5 | req | src/express.js:46:22:51:1 | functio ... ame];\\n} |
+| src/express.js:48:3:48:5 | req | src/express.js:46:22:51:1 | functio ... ame];\\n} |
+| src/express.js:49:3:49:5 | req | src/express.js:46:22:51:1 | functio ... ame];\\n} |
+| src/express.js:50:3:50:5 | req | src/express.js:46:22:51:1 | functio ... ame];\\n} |
 | src/responseExprs.js:17:5:17:7 | req | src/responseExprs.js:16:30:42:1 | functio ...     }\\n} |
diff --git a/javascript/ql/test/library-tests/frameworks/Express/RouteHandler.expected b/javascript/ql/test/library-tests/frameworks/Express/RouteHandler.expected
index 16d1cfbe68dd..babfdaa6bfa1 100644
--- a/javascript/ql/test/library-tests/frameworks/Express/RouteHandler.expected
+++ b/javascript/ql/test/library-tests/frameworks/Express/RouteHandler.expected
@@ -14,7 +14,7 @@
 | src/express.js:22:30:32:1 | functio ... ar');\\n} | src/express.js:22:39:22:41 | req | src/express.js:22:44:22:46 | res |
 | src/express.js:37:12:37:32 | functio ...  res){} | src/express.js:37:22:37:24 | req | src/express.js:37:27:37:29 | res |
 | src/express.js:42:12:42:28 | (req, res) => f() | src/express.js:42:13:42:15 | req | src/express.js:42:18:42:20 | res |
-| src/express.js:46:22:50:1 | functio ... name;\\n} | src/express.js:46:31:46:33 | req | src/express.js:46:36:46:38 | res |
+| src/express.js:46:22:51:1 | functio ... ame];\\n} | src/express.js:46:31:46:33 | req | src/express.js:46:36:46:38 | res |
 | src/responseExprs.js:4:23:6:1 | functio ...  res1\\n} | src/responseExprs.js:4:32:4:34 | req | src/responseExprs.js:4:37:4:40 | res1 |
 | src/responseExprs.js:7:23:9:1 | functio ... res2;\\n} | src/responseExprs.js:7:32:7:34 | req | src/responseExprs.js:7:37:7:40 | res2 |
 | src/responseExprs.js:10:23:12:1 | functio ... res3;\\n} | src/responseExprs.js:10:39:10:41 | req | src/responseExprs.js:10:44:10:47 | res3 |
diff --git a/javascript/ql/test/library-tests/frameworks/Express/RouteHandlerExpr.expected b/javascript/ql/test/library-tests/frameworks/Express/RouteHandlerExpr.expected
index ea23e2485942..e288c556b8c4 100644
--- a/javascript/ql/test/library-tests/frameworks/Express/RouteHandlerExpr.expected
+++ b/javascript/ql/test/library-tests/frameworks/Express/RouteHandlerExpr.expected
@@ -20,7 +20,7 @@
 | src/express.js:34:14:34:52 | require ... handler | src/express.js:34:1:34:53 | app.get ... andler) | true |
 | src/express.js:39:9:39:20 | getHandler() | src/express.js:39:1:39:21 | app.use ... dler()) | false |
 | src/express.js:44:9:44:25 | getArrowHandler() | src/express.js:44:1:44:26 | app.use ... dler()) | false |
-| src/express.js:46:22:50:1 | functio ... name;\\n} | src/express.js:46:1:50:2 | app.pos ... ame;\\n}) | true |
+| src/express.js:46:22:51:1 | functio ... ame];\\n} | src/express.js:46:1:51:2 | app.pos ... me];\\n}) | true |
 | src/responseExprs.js:4:23:6:1 | functio ...  res1\\n} | src/responseExprs.js:4:1:6:2 | app.get ... res1\\n}) | true |
 | src/responseExprs.js:7:23:9:1 | functio ... res2;\\n} | src/responseExprs.js:7:1:9:2 | app.get ... es2;\\n}) | true |
 | src/responseExprs.js:10:23:12:1 | functio ... res3;\\n} | src/responseExprs.js:10:1:12:2 | app.get ... es3;\\n}) | true |
diff --git a/javascript/ql/test/library-tests/frameworks/Express/RouteHandlerExpr_getAMatchingAncestor.expected b/javascript/ql/test/library-tests/frameworks/Express/RouteHandlerExpr_getAMatchingAncestor.expected
index 3f48873daa7b..e4bd32539d9a 100644
--- a/javascript/ql/test/library-tests/frameworks/Express/RouteHandlerExpr_getAMatchingAncestor.expected
+++ b/javascript/ql/test/library-tests/frameworks/Express/RouteHandlerExpr_getAMatchingAncestor.expected
@@ -16,5 +16,5 @@
 | src/express.js:16:19:18:3 | functio ... ");\\n  } | src/express.js:39:9:39:20 | getHandler() |
 | src/express.js:16:19:18:3 | functio ... ");\\n  } | src/express.js:44:9:44:25 | getArrowHandler() |
 | src/express.js:44:9:44:25 | getArrowHandler() | src/express.js:39:9:39:20 | getHandler() |
-| src/express.js:46:22:50:1 | functio ... name;\\n} | src/express.js:39:9:39:20 | getHandler() |
-| src/express.js:46:22:50:1 | functio ... name;\\n} | src/express.js:44:9:44:25 | getArrowHandler() |
+| src/express.js:46:22:51:1 | functio ... ame];\\n} | src/express.js:39:9:39:20 | getHandler() |
+| src/express.js:46:22:51:1 | functio ... ame];\\n} | src/express.js:44:9:44:25 | getArrowHandler() |
diff --git a/javascript/ql/test/library-tests/frameworks/Express/RouteHandlerExpr_getBody.expected b/javascript/ql/test/library-tests/frameworks/Express/RouteHandlerExpr_getBody.expected
index 2c79ac135a61..f4805a5e53e6 100644
--- a/javascript/ql/test/library-tests/frameworks/Express/RouteHandlerExpr_getBody.expected
+++ b/javascript/ql/test/library-tests/frameworks/Express/RouteHandlerExpr_getBody.expected
@@ -10,7 +10,7 @@
 | src/express.js:4:23:9:1 | functio ... res);\\n} | src/express.js:4:23:9:1 | functio ... res);\\n} |
 | src/express.js:16:19:18:3 | functio ... ");\\n  } | src/express.js:16:19:18:3 | functio ... ");\\n  } |
 | src/express.js:22:30:32:1 | functio ... ar');\\n} | src/express.js:22:30:32:1 | functio ... ar');\\n} |
-| src/express.js:46:22:50:1 | functio ... name;\\n} | src/express.js:46:22:50:1 | functio ... name;\\n} |
+| src/express.js:46:22:51:1 | functio ... ame];\\n} | src/express.js:46:22:51:1 | functio ... ame];\\n} |
 | src/responseExprs.js:4:23:6:1 | functio ...  res1\\n} | src/responseExprs.js:4:23:6:1 | functio ...  res1\\n} |
 | src/responseExprs.js:7:23:9:1 | functio ... res2;\\n} | src/responseExprs.js:7:23:9:1 | functio ... res2;\\n} |
 | src/responseExprs.js:10:23:12:1 | functio ... res3;\\n} | src/responseExprs.js:10:23:12:1 | functio ... res3;\\n} |
diff --git a/javascript/ql/test/library-tests/frameworks/Express/RouteHandlerExpr_getNextMiddleware.expected b/javascript/ql/test/library-tests/frameworks/Express/RouteHandlerExpr_getNextMiddleware.expected
index 8aa06c0a8d6d..b7081b75823f 100644
--- a/javascript/ql/test/library-tests/frameworks/Express/RouteHandlerExpr_getNextMiddleware.expected
+++ b/javascript/ql/test/library-tests/frameworks/Express/RouteHandlerExpr_getNextMiddleware.expected
@@ -7,5 +7,5 @@
 | src/csurf-example.js:18:9:18:30 | csrf({  ... true }) | src/csurf-example.js:40:27:40:48 | functio ... res) {} |
 | src/express.js:39:9:39:20 | getHandler() | src/express.js:44:9:44:25 | getArrowHandler() |
 | src/express.js:44:9:44:25 | getArrowHandler() | src/express.js:16:19:18:3 | functio ... ");\\n  } |
-| src/express.js:44:9:44:25 | getArrowHandler() | src/express.js:46:22:50:1 | functio ... name;\\n} |
+| src/express.js:44:9:44:25 | getArrowHandler() | src/express.js:46:22:51:1 | functio ... ame];\\n} |
 | src/subrouter.js:4:19:4:25 | protect | src/subrouter.js:5:14:5:28 | makeSubRouter() |
diff --git a/javascript/ql/test/library-tests/frameworks/Express/RouteHandlerExpr_getPreviousMiddleware.expected b/javascript/ql/test/library-tests/frameworks/Express/RouteHandlerExpr_getPreviousMiddleware.expected
index c1f2223bf3e8..63f85929c59c 100644
--- a/javascript/ql/test/library-tests/frameworks/Express/RouteHandlerExpr_getPreviousMiddleware.expected
+++ b/javascript/ql/test/library-tests/frameworks/Express/RouteHandlerExpr_getPreviousMiddleware.expected
@@ -7,5 +7,5 @@
 | src/csurf-example.js:40:27:40:48 | functio ... res) {} | src/csurf-example.js:18:9:18:30 | csrf({  ... true }) |
 | src/express.js:16:19:18:3 | functio ... ");\\n  } | src/express.js:44:9:44:25 | getArrowHandler() |
 | src/express.js:44:9:44:25 | getArrowHandler() | src/express.js:39:9:39:20 | getHandler() |
-| src/express.js:46:22:50:1 | functio ... name;\\n} | src/express.js:44:9:44:25 | getArrowHandler() |
+| src/express.js:46:22:51:1 | functio ... ame];\\n} | src/express.js:44:9:44:25 | getArrowHandler() |
 | src/subrouter.js:5:14:5:28 | makeSubRouter() | src/subrouter.js:4:19:4:25 | protect |
diff --git a/javascript/ql/test/library-tests/frameworks/Express/RouteHandler_getARequestExpr.expected b/javascript/ql/test/library-tests/frameworks/Express/RouteHandler_getARequestExpr.expected
index 23d8c7ee264f..732a9e8391e2 100644
--- a/javascript/ql/test/library-tests/frameworks/Express/RouteHandler_getARequestExpr.expected
+++ b/javascript/ql/test/library-tests/frameworks/Express/RouteHandler_getARequestExpr.expected
@@ -14,7 +14,8 @@
 | src/express.js:22:30:32:1 | functio ... ar');\\n} | src/express.js:28:3:28:5 | req |
 | src/express.js:22:30:32:1 | functio ... ar');\\n} | src/express.js:29:3:29:5 | req |
 | src/express.js:22:30:32:1 | functio ... ar');\\n} | src/express.js:30:3:30:5 | req |
-| src/express.js:46:22:50:1 | functio ... name;\\n} | src/express.js:47:3:47:5 | req |
-| src/express.js:46:22:50:1 | functio ... name;\\n} | src/express.js:48:3:48:5 | req |
-| src/express.js:46:22:50:1 | functio ... name;\\n} | src/express.js:49:3:49:5 | req |
+| src/express.js:46:22:51:1 | functio ... ame];\\n} | src/express.js:47:3:47:5 | req |
+| src/express.js:46:22:51:1 | functio ... ame];\\n} | src/express.js:48:3:48:5 | req |
+| src/express.js:46:22:51:1 | functio ... ame];\\n} | src/express.js:49:3:49:5 | req |
+| src/express.js:46:22:51:1 | functio ... ame];\\n} | src/express.js:50:3:50:5 | req |
 | src/responseExprs.js:16:30:42:1 | functio ...     }\\n} | src/responseExprs.js:17:5:17:7 | req |
diff --git a/javascript/ql/test/library-tests/frameworks/Express/RouteSetup.expected b/javascript/ql/test/library-tests/frameworks/Express/RouteSetup.expected
index e59183f81608..8112a1636a96 100644
--- a/javascript/ql/test/library-tests/frameworks/Express/RouteSetup.expected
+++ b/javascript/ql/test/library-tests/frameworks/Express/RouteSetup.expected
@@ -9,7 +9,7 @@
 | src/express.js:4:1:9:2 | app.get ... es);\\n}) | src/express.js:2:11:2:19 | express() | false |
 | src/express.js:16:3:18:4 | router. ... );\\n  }) | src/express.js:2:11:2:19 | express() | false |
 | src/express.js:22:1:32:2 | app.pos ... r');\\n}) | src/express.js:2:11:2:19 | express() | false |
-| src/express.js:46:1:50:2 | app.pos ... ame;\\n}) | src/express.js:2:11:2:19 | express() | false |
+| src/express.js:46:1:51:2 | app.pos ... me];\\n}) | src/express.js:2:11:2:19 | express() | false |
 | src/responseExprs.js:4:1:6:2 | app.get ... res1\\n}) | src/responseExprs.js:2:11:2:19 | express() | false |
 | src/responseExprs.js:7:1:9:2 | app.get ... es2;\\n}) | src/responseExprs.js:2:11:2:19 | express() | false |
 | src/responseExprs.js:10:1:12:2 | app.get ... es3;\\n}) | src/responseExprs.js:2:11:2:19 | express() | false |
diff --git a/javascript/ql/test/library-tests/frameworks/Express/RouteSetup_getARouteHandler.expected b/javascript/ql/test/library-tests/frameworks/Express/RouteSetup_getARouteHandler.expected
index 4352f83b53c7..7ed8331c31de 100644
--- a/javascript/ql/test/library-tests/frameworks/Express/RouteSetup_getARouteHandler.expected
+++ b/javascript/ql/test/library-tests/frameworks/Express/RouteSetup_getARouteHandler.expected
@@ -25,7 +25,7 @@
 | src/express.js:39:1:39:21 | app.use ... dler()) | src/express.js:39:9:39:20 | getHandler() |
 | src/express.js:44:1:44:26 | app.use ... dler()) | src/express.js:42:12:42:28 | (req, res) => f() |
 | src/express.js:44:1:44:26 | app.use ... dler()) | src/express.js:44:9:44:25 | getArrowHandler() |
-| src/express.js:46:1:50:2 | app.pos ... ame;\\n}) | src/express.js:46:22:50:1 | functio ... name;\\n} |
+| src/express.js:46:1:51:2 | app.pos ... me];\\n}) | src/express.js:46:22:51:1 | functio ... ame];\\n} |
 | src/responseExprs.js:4:1:6:2 | app.get ... res1\\n}) | src/responseExprs.js:4:23:6:1 | functio ...  res1\\n} |
 | src/responseExprs.js:7:1:9:2 | app.get ... es2;\\n}) | src/responseExprs.js:7:23:9:1 | functio ... res2;\\n} |
 | src/responseExprs.js:10:1:12:2 | app.get ... es3;\\n}) | src/responseExprs.js:10:23:12:1 | functio ... res3;\\n} |
diff --git a/javascript/ql/test/library-tests/frameworks/Express/RouteSetup_getARouteHandlerExpr.expected b/javascript/ql/test/library-tests/frameworks/Express/RouteSetup_getARouteHandlerExpr.expected
index d350d2943717..e788350ad5f2 100644
--- a/javascript/ql/test/library-tests/frameworks/Express/RouteSetup_getARouteHandlerExpr.expected
+++ b/javascript/ql/test/library-tests/frameworks/Express/RouteSetup_getARouteHandlerExpr.expected
@@ -20,7 +20,7 @@
 | src/express.js:34:1:34:53 | app.get ... andler) | src/express.js:34:14:34:52 | require ... handler |
 | src/express.js:39:1:39:21 | app.use ... dler()) | src/express.js:39:9:39:20 | getHandler() |
 | src/express.js:44:1:44:26 | app.use ... dler()) | src/express.js:44:9:44:25 | getArrowHandler() |
-| src/express.js:46:1:50:2 | app.pos ... ame;\\n}) | src/express.js:46:22:50:1 | functio ... name;\\n} |
+| src/express.js:46:1:51:2 | app.pos ... me];\\n}) | src/express.js:46:22:51:1 | functio ... ame];\\n} |
 | src/responseExprs.js:4:1:6:2 | app.get ... res1\\n}) | src/responseExprs.js:4:23:6:1 | functio ...  res1\\n} |
 | src/responseExprs.js:7:1:9:2 | app.get ... es2;\\n}) | src/responseExprs.js:7:23:9:1 | functio ... res2;\\n} |
 | src/responseExprs.js:10:1:12:2 | app.get ... es3;\\n}) | src/responseExprs.js:10:23:12:1 | functio ... res3;\\n} |
diff --git a/javascript/ql/test/library-tests/frameworks/Express/RouteSetup_getLastRouteHandlerExpr.expected b/javascript/ql/test/library-tests/frameworks/Express/RouteSetup_getLastRouteHandlerExpr.expected
index d350d2943717..e788350ad5f2 100644
--- a/javascript/ql/test/library-tests/frameworks/Express/RouteSetup_getLastRouteHandlerExpr.expected
+++ b/javascript/ql/test/library-tests/frameworks/Express/RouteSetup_getLastRouteHandlerExpr.expected
@@ -20,7 +20,7 @@
 | src/express.js:34:1:34:53 | app.get ... andler) | src/express.js:34:14:34:52 | require ... handler |
 | src/express.js:39:1:39:21 | app.use ... dler()) | src/express.js:39:9:39:20 | getHandler() |
 | src/express.js:44:1:44:26 | app.use ... dler()) | src/express.js:44:9:44:25 | getArrowHandler() |
-| src/express.js:46:1:50:2 | app.pos ... ame;\\n}) | src/express.js:46:22:50:1 | functio ... name;\\n} |
+| src/express.js:46:1:51:2 | app.pos ... me];\\n}) | src/express.js:46:22:51:1 | functio ... ame];\\n} |
 | src/responseExprs.js:4:1:6:2 | app.get ... res1\\n}) | src/responseExprs.js:4:23:6:1 | functio ...  res1\\n} |
 | src/responseExprs.js:7:1:9:2 | app.get ... es2;\\n}) | src/responseExprs.js:7:23:9:1 | functio ... res2;\\n} |
 | src/responseExprs.js:10:1:12:2 | app.get ... es3;\\n}) | src/responseExprs.js:10:23:12:1 | functio ... res3;\\n} |
diff --git a/javascript/ql/test/library-tests/frameworks/Express/RouteSetup_getRequestMethod.expected b/javascript/ql/test/library-tests/frameworks/Express/RouteSetup_getRequestMethod.expected
index be97e5c4a592..ef656f126633 100644
--- a/javascript/ql/test/library-tests/frameworks/Express/RouteSetup_getRequestMethod.expected
+++ b/javascript/ql/test/library-tests/frameworks/Express/RouteSetup_getRequestMethod.expected
@@ -11,7 +11,7 @@
 | src/express.js:16:3:18:4 | router. ... );\\n  }) | GET |
 | src/express.js:22:1:32:2 | app.pos ... r');\\n}) | POST |
 | src/express.js:34:1:34:53 | app.get ... andler) | GET |
-| src/express.js:46:1:50:2 | app.pos ... ame;\\n}) | POST |
+| src/express.js:46:1:51:2 | app.pos ... me];\\n}) | POST |
 | src/responseExprs.js:4:1:6:2 | app.get ... res1\\n}) | GET |
 | src/responseExprs.js:7:1:9:2 | app.get ... es2;\\n}) | GET |
 | src/responseExprs.js:10:1:12:2 | app.get ... es3;\\n}) | GET |
diff --git a/javascript/ql/test/library-tests/frameworks/Express/RouteSetup_getRouteHandlerExpr.expected b/javascript/ql/test/library-tests/frameworks/Express/RouteSetup_getRouteHandlerExpr.expected
index 215340c51df3..61ae5da20308 100644
--- a/javascript/ql/test/library-tests/frameworks/Express/RouteSetup_getRouteHandlerExpr.expected
+++ b/javascript/ql/test/library-tests/frameworks/Express/RouteSetup_getRouteHandlerExpr.expected
@@ -20,7 +20,7 @@
 | src/express.js:34:1:34:53 | app.get ... andler) | 0 | src/express.js:34:14:34:52 | require ... handler |
 | src/express.js:39:1:39:21 | app.use ... dler()) | 0 | src/express.js:39:9:39:20 | getHandler() |
 | src/express.js:44:1:44:26 | app.use ... dler()) | 0 | src/express.js:44:9:44:25 | getArrowHandler() |
-| src/express.js:46:1:50:2 | app.pos ... ame;\\n}) | 0 | src/express.js:46:22:50:1 | functio ... name;\\n} |
+| src/express.js:46:1:51:2 | app.pos ... me];\\n}) | 0 | src/express.js:46:22:51:1 | functio ... ame];\\n} |
 | src/responseExprs.js:4:1:6:2 | app.get ... res1\\n}) | 0 | src/responseExprs.js:4:23:6:1 | functio ...  res1\\n} |
 | src/responseExprs.js:7:1:9:2 | app.get ... es2;\\n}) | 0 | src/responseExprs.js:7:23:9:1 | functio ... res2;\\n} |
 | src/responseExprs.js:10:1:12:2 | app.get ... es3;\\n}) | 0 | src/responseExprs.js:10:23:12:1 | functio ... res3;\\n} |
diff --git a/javascript/ql/test/library-tests/frameworks/Express/RouteSetup_getRouter.expected b/javascript/ql/test/library-tests/frameworks/Express/RouteSetup_getRouter.expected
index dfeaa9922949..46af44628f11 100644
--- a/javascript/ql/test/library-tests/frameworks/Express/RouteSetup_getRouter.expected
+++ b/javascript/ql/test/library-tests/frameworks/Express/RouteSetup_getRouter.expected
@@ -20,7 +20,7 @@
 | src/express.js:34:1:34:53 | app.get ... andler) | src/express.js:2:11:2:19 | express() |
 | src/express.js:39:1:39:21 | app.use ... dler()) | src/express.js:2:11:2:19 | express() |
 | src/express.js:44:1:44:26 | app.use ... dler()) | src/express.js:2:11:2:19 | express() |
-| src/express.js:46:1:50:2 | app.pos ... ame;\\n}) | src/express.js:2:11:2:19 | express() |
+| src/express.js:46:1:51:2 | app.pos ... me];\\n}) | src/express.js:2:11:2:19 | express() |
 | src/responseExprs.js:4:1:6:2 | app.get ... res1\\n}) | src/responseExprs.js:2:11:2:19 | express() |
 | src/responseExprs.js:7:1:9:2 | app.get ... es2;\\n}) | src/responseExprs.js:2:11:2:19 | express() |
 | src/responseExprs.js:10:1:12:2 | app.get ... es3;\\n}) | src/responseExprs.js:2:11:2:19 | express() |
diff --git a/javascript/ql/test/library-tests/frameworks/Express/RouteSetup_getServer.expected b/javascript/ql/test/library-tests/frameworks/Express/RouteSetup_getServer.expected
index 23da8a6bdaa1..a37c24eeeda3 100644
--- a/javascript/ql/test/library-tests/frameworks/Express/RouteSetup_getServer.expected
+++ b/javascript/ql/test/library-tests/frameworks/Express/RouteSetup_getServer.expected
@@ -9,7 +9,7 @@
 | src/express.js:4:1:9:2 | app.get ... es);\\n}) | src/express.js:2:11:2:19 | express() |
 | src/express.js:16:3:18:4 | router. ... );\\n  }) | src/express.js:2:11:2:19 | express() |
 | src/express.js:22:1:32:2 | app.pos ... r');\\n}) | src/express.js:2:11:2:19 | express() |
-| src/express.js:46:1:50:2 | app.pos ... ame;\\n}) | src/express.js:2:11:2:19 | express() |
+| src/express.js:46:1:51:2 | app.pos ... me];\\n}) | src/express.js:2:11:2:19 | express() |
 | src/responseExprs.js:4:1:6:2 | app.get ... res1\\n}) | src/responseExprs.js:2:11:2:19 | express() |
 | src/responseExprs.js:7:1:9:2 | app.get ... es2;\\n}) | src/responseExprs.js:2:11:2:19 | express() |
 | src/responseExprs.js:10:1:12:2 | app.get ... es3;\\n}) | src/responseExprs.js:2:11:2:19 | express() |
diff --git a/javascript/ql/test/library-tests/frameworks/Express/RouterDefinition_getARouteHandler.expected b/javascript/ql/test/library-tests/frameworks/Express/RouterDefinition_getARouteHandler.expected
index e10a8c517121..7a37c4c671e5 100644
--- a/javascript/ql/test/library-tests/frameworks/Express/RouterDefinition_getARouteHandler.expected
+++ b/javascript/ql/test/library-tests/frameworks/Express/RouterDefinition_getARouteHandler.expected
@@ -9,7 +9,7 @@
 | src/express.js:2:11:2:19 | express() | src/express.js:4:23:9:1 | functio ... res);\\n} |
 | src/express.js:2:11:2:19 | express() | src/express.js:16:19:18:3 | functio ... ");\\n  } |
 | src/express.js:2:11:2:19 | express() | src/express.js:22:30:32:1 | functio ... ar');\\n} |
-| src/express.js:2:11:2:19 | express() | src/express.js:46:22:50:1 | functio ... name;\\n} |
+| src/express.js:2:11:2:19 | express() | src/express.js:46:22:51:1 | functio ... ame];\\n} |
 | src/responseExprs.js:2:11:2:19 | express() | src/responseExprs.js:4:23:6:1 | functio ...  res1\\n} |
 | src/responseExprs.js:2:11:2:19 | express() | src/responseExprs.js:7:23:9:1 | functio ... res2;\\n} |
 | src/responseExprs.js:2:11:2:19 | express() | src/responseExprs.js:10:23:12:1 | functio ... res3;\\n} |
diff --git a/javascript/ql/test/library-tests/frameworks/Express/RouterDefinition_getMiddlewareStackAt.expected b/javascript/ql/test/library-tests/frameworks/Express/RouterDefinition_getMiddlewareStackAt.expected
index 0db82edd5d4c..fd3766cb7b38 100644
--- a/javascript/ql/test/library-tests/frameworks/Express/RouterDefinition_getMiddlewareStackAt.expected
+++ b/javascript/ql/test/library-tests/frameworks/Express/RouterDefinition_getMiddlewareStackAt.expected
@@ -77,12 +77,12 @@
 | src/express.js:2:11:2:19 | express() | src/express.js:44:9:44:25 | getArrowHandler() | src/express.js:39:9:39:20 | getHandler() |
 | src/express.js:2:11:2:19 | express() | src/express.js:46:1:46:3 | app | src/express.js:44:9:44:25 | getArrowHandler() |
 | src/express.js:2:11:2:19 | express() | src/express.js:46:1:46:8 | app.post | src/express.js:44:9:44:25 | getArrowHandler() |
-| src/express.js:2:11:2:19 | express() | src/express.js:46:1:50:2 | app.pos ... ame;\\n}) | src/express.js:44:9:44:25 | getArrowHandler() |
-| src/express.js:2:11:2:19 | express() | src/express.js:46:1:50:3 | app.pos ... me;\\n}); | src/express.js:44:9:44:25 | getArrowHandler() |
+| src/express.js:2:11:2:19 | express() | src/express.js:46:1:51:2 | app.pos ... me];\\n}) | src/express.js:44:9:44:25 | getArrowHandler() |
+| src/express.js:2:11:2:19 | express() | src/express.js:46:1:51:3 | app.pos ... e];\\n}); | src/express.js:44:9:44:25 | getArrowHandler() |
 | src/express.js:2:11:2:19 | express() | src/express.js:46:5:46:8 | post | src/express.js:44:9:44:25 | getArrowHandler() |
 | src/express.js:2:11:2:19 | express() | src/express.js:46:10:46:19 | '/headers' | src/express.js:44:9:44:25 | getArrowHandler() |
-| src/express.js:2:11:2:19 | express() | src/express.js:46:22:50:1 | functio ... name;\\n} | src/express.js:44:9:44:25 | getArrowHandler() |
-| src/express.js:2:11:2:19 | express() | src/express.js:51:1:51:0 | exit node of <toplevel> | src/express.js:44:9:44:25 | getArrowHandler() |
+| src/express.js:2:11:2:19 | express() | src/express.js:46:22:51:1 | functio ... ame];\\n} | src/express.js:44:9:44:25 | getArrowHandler() |
+| src/express.js:2:11:2:19 | express() | src/express.js:52:1:52:0 | exit node of <toplevel> | src/express.js:44:9:44:25 | getArrowHandler() |
 | src/subrouter.js:2:11:2:19 | express() | src/subrouter.js:4:1:4:26 | app.use ... rotect) | src/subrouter.js:4:19:4:25 | protect |
 | src/subrouter.js:2:11:2:19 | express() | src/subrouter.js:5:1:5:3 | app | src/subrouter.js:4:19:4:25 | protect |
 | src/subrouter.js:2:11:2:19 | express() | src/subrouter.js:5:1:5:7 | app.use | src/subrouter.js:4:19:4:25 | protect |
diff --git a/javascript/ql/test/library-tests/frameworks/Express/StandardRouteHandler.expected b/javascript/ql/test/library-tests/frameworks/Express/StandardRouteHandler.expected
index a6d30697915d..dfd0a7058130 100644
--- a/javascript/ql/test/library-tests/frameworks/Express/StandardRouteHandler.expected
+++ b/javascript/ql/test/library-tests/frameworks/Express/StandardRouteHandler.expected
@@ -9,7 +9,7 @@
 | src/express.js:4:23:9:1 | functio ... res);\\n} | src/express.js:2:11:2:19 | express() | src/express.js:4:32:4:34 | req | src/express.js:4:37:4:39 | res |
 | src/express.js:16:19:18:3 | functio ... ");\\n  } | src/express.js:2:11:2:19 | express() | src/express.js:16:28:16:30 | req | src/express.js:16:33:16:35 | res |
 | src/express.js:22:30:32:1 | functio ... ar');\\n} | src/express.js:2:11:2:19 | express() | src/express.js:22:39:22:41 | req | src/express.js:22:44:22:46 | res |
-| src/express.js:46:22:50:1 | functio ... name;\\n} | src/express.js:2:11:2:19 | express() | src/express.js:46:31:46:33 | req | src/express.js:46:36:46:38 | res |
+| src/express.js:46:22:51:1 | functio ... ame];\\n} | src/express.js:2:11:2:19 | express() | src/express.js:46:31:46:33 | req | src/express.js:46:36:46:38 | res |
 | src/responseExprs.js:4:23:6:1 | functio ...  res1\\n} | src/responseExprs.js:2:11:2:19 | express() | src/responseExprs.js:4:32:4:34 | req | src/responseExprs.js:4:37:4:40 | res1 |
 | src/responseExprs.js:7:23:9:1 | functio ... res2;\\n} | src/responseExprs.js:2:11:2:19 | express() | src/responseExprs.js:7:32:7:34 | req | src/responseExprs.js:7:37:7:40 | res2 |
 | src/responseExprs.js:10:23:12:1 | functio ... res3;\\n} | src/responseExprs.js:2:11:2:19 | express() | src/responseExprs.js:10:39:10:41 | req | src/responseExprs.js:10:44:10:47 | res3 |
diff --git a/javascript/ql/test/library-tests/frameworks/Express/isRequest.expected b/javascript/ql/test/library-tests/frameworks/Express/isRequest.expected
index 5b2915b2b384..d36af77ff644 100644
--- a/javascript/ql/test/library-tests/frameworks/Express/isRequest.expected
+++ b/javascript/ql/test/library-tests/frameworks/Express/isRequest.expected
@@ -17,4 +17,5 @@
 | src/express.js:47:3:47:5 | req |
 | src/express.js:48:3:48:5 | req |
 | src/express.js:49:3:49:5 | req |
+| src/express.js:50:3:50:5 | req |
 | src/responseExprs.js:17:5:17:7 | req |