codeql/javascript/ql/test/query-tests/Security/CWE-598/tst.js

const express = require('express');
const app = express();
const bodyParser = require('body-parser');
app.use(bodyParser.urlencoded({extended: true}));

app.get("/login", (req, res) => {
    const username = req.query.username; // OK - usernames are fine
    const password = req.query.password; // $ Alert - password read
    checkUser(username, password, (result) => {
        res.send(result);
    });

    doThing(req.query.userId); // OK - userId
});

app.post("/login", (req, res) => {
    const username = req.body.username; // OK - usernames are fine
    const password = req.body.password; // OK - not a query parameter
    checkUser(username, password, (result) => {
        res.send(result);
    });
});

app.get("/login2", (req, res) => {
    const username = req.param('username'); // OK - usernames are fine
    const password = req.param('password'); // $ Alert - password read
    checkUser(username, password, (result) => {
        res.send(result);
    });

    const myPassword = req.param('word'); // $ Alert - is used in a sensitive write below.
    checkUser(username, myPassword, (result) => {
        res.send(result);
    });
});

app.get("/login", ({query}, res) => {
    const username = query.username; // OK - usernames are fine
    const currentPassword = query.current; // $ Alert - password read
    checkUser(username, currentPassword, (result) => {
        res.send(result);
    });
});

app.get('/rest/user/change-password', mkHandler());

function mkHandler() {
    return (req, res) => {
        const username = req.param('username'); // OK - usernames are fine
        const currentPassword = req.param('current'); // $ Alert - password read
        checkUser(username, currentPassword, (result) => {
            res.send(result);
        });
    }
}