Merge pull request #1314 from xiemaisi/js/fix-hardcoded-pw-fps

JavaScript: Further broaden the whitelist in `PasswordInConfigurationFile`.

javascript/ql/src/Security/CWE-313/PasswordInConfigurationFile.ql

@@ -54,7 +54,7 @@ where
   (
     key.toLowerCase() = "password" and
     // exclude interpolations of environment variables
-    not val.regexpMatch("\\$\\w+|\\$[{(].+[)}]|%.*%")
+    not val.regexpMatch("\\$.*|%.*%")
     or
     key.toLowerCase() != "readme" and
     // look for `password=...`, but exclude `password=;`, `password="$(...)"`,

javascript/ql/test/query-tests/Security/CWE-313/tst7.yml

@@ -0,0 +1 @@
+password: $$SOME_VAR