Add fixed proposition for NodeJS

javascript/ql/src/Security/CWE-798/HardcodedCredentials.qhelp

@@ -33,6 +33,10 @@
     <code>username</code> and <code>password</code>, which can be set externally without hard-coding
     credentials in the source code.
   </p>
+
+  For example, in a NodeJS environment : 
+  <sample src="examples/HardcodedCredentialsHttpRequestFixed.js"/>
+
 </example>
 
 <example>

javascript/ql/src/Security/CWE-798/examples/HardcodedCredentialsHttpRequest.js

@@ -11,8 +11,8 @@ headers.append('Authorization', 'Basic' + base64.encode(username + ":" + passwor
 
 fetch(url, {method:'GET',
         headers: headers,
-        //credentials: 'user:passwd'
+        credentials: `${user}:${passwd}`
        })
 .then(response => response.json())
 .then(json => console.log(json));
-//.done();
+.done();

javascript/ql/src/Security/CWE-798/examples/HardcodedCredentialsHttpRequestFixed.js

@@ -0,0 +1,18 @@
+let base64 = require('base-64');
+
+let url = 'http://example.org/auth';
+let username = process.env.USERNAME;
+let password = process.env.PASSWORD;
+
+let headers = new Headers();
+
+//headers.append('Content-Type', 'text/json');
+headers.append('Authorization', 'Basic' + base64.encode(username + ":" + password));
+
+fetch(url, {method:'GET',
+        headers: headers,
+        credentials: `${user}:${passwd}`
+       })
+.then(response => response.json())
+.then(json => console.log(json));
+.done();