codeql/javascript/ql/test/query-tests/Security/CWE-918/serverSide2.js

const express = require('express');
const axios = require('axios');
const qs = require('qs');

const app = express();
const PORT = 3000;

app.use((req, res, next) => {
  req.parsedQueryFromParsedUrl = qs.parse(req._parsedUrl.query);  // $ Source[js/request-forgery]
  req.parsedQuery.url = req.url || {}; // $ Source[js/request-forgery]
  req.SomeObject.url = req.url; // $ Source[js/request-forgery]
  next();
});

app.get('/proxy', async (req, res) => {
  const targetUrl = req.parsedQuery.url;
  const response = await axios.get(targetUrl); // $ Alert[js/request-forgery]

  const targetUrl1 = req.parsedQueryFromParsedUrl.url;
  const response1 = await axios.get(targetUrl1); // $ Alert[js/request-forgery]

  const targetUrl2 = req.url || {};  // $ Source[js/request-forgery]
  const response2 = await axios.get(targetUrl2);  // $ Alert[js/request-forgery]

  const targetUrl3 = req.SomeObject.url || {};
  const response3 = await axios.get(targetUrl3);  // $ Alert[js/request-forgery]
});