Merge remote-tracking branch 'upstream/master' into merge-master-next-20180913

javascript/ql/src/semmle/javascript/frameworks/Bundling.qll

@@ -213,6 +213,7 @@ Comment getExclamationPointCommentInRun(ExclamationPointComment head) {
  * Holds if this is a bundle containing multiple licenses.
  */
 predicate isMultiLicenseBundle(TopLevel tl) {
+  // case: comments preserved by minifiers
   count(ExclamationPointComment head |
     head.getTopLevel() = tl and
     exists(ExclamationPointComment licenseIndicator |
@@ -220,6 +221,12 @@ predicate isMultiLicenseBundle(TopLevel tl) {
       licenseIndicator.getLine(_).regexpMatch("(?i).*\\b(copyright|license|\\d+\\.\\d+)\\b.*")
     )
   ) > 1
+  or
+  // case: ordinary block comments with "@license" lines
+  count(BlockComment head |
+    head.getTopLevel() = tl and
+    head.getLine(_).regexpMatch("(?i) *\\* @license .*")
+  ) > 1
 }
 
 /**

javascript/ql/test/query-tests/Security/CWE-730/RegExpInjection.js

@@ -1,6 +1,6 @@
 var express = require('express');
 var app = express();
-var URI = reuires("urijs");
+var URI = require("urijs");
 app.get('/findKey', function(req, res) {
   var key = req.param("key"), input = req.param("input");
 

javascript/ql/test/query-tests/filters/ClassifyFiles/ClassifyFiles.expected

@@ -11,6 +11,7 @@
 | jsx.js:0:0:0:0 | jsx.js | generated |
 | multi-part-bundle.html:0:0:0:0 | multi-part-bundle.html | generated |
 | multi-part-bundle.js:0:0:0:0 | multi-part-bundle.js | generated |
+| multiple-licenses-2.js:0:0:0:0 | multiple-licenses-2.js | generated |
 | multiple-licenses.js:0:0:0:0 | multiple-licenses.js | generated |
 | opal-test.js:0:0:0:0 | opal-test.js | generated |
 | peg-js.js:0:0:0:0 | peg-js.js | generated |

javascript/ql/test/query-tests/filters/ClassifyFiles/multiple-licenses-2.js

@@ -0,0 +1,10 @@
+/*
+ * @copyright (c) ...
+ * @copyright (c) ...
+ * @license ...
+ */
+
+/**
+ * @copyright ...
+ * @license ...
+ */