JS: Expand test case

Author: asgerf

javascript/ql/test/query-tests/Security/CWE-843/TypeConfusionThroughParameterTampering.expected

@@ -37,6 +37,11 @@ nodes
 | tst.js:98:9:98:16 | data.foo |
 | tst.js:98:9:98:16 | data.foo |
 | tst.js:98:9:98:16 | data.foo |
+| tst.js:103:9:103:29 | data |
+| tst.js:103:16:103:29 | req.query.data |
+| tst.js:103:16:103:29 | req.query.data |
+| tst.js:104:5:104:8 | data |
+| tst.js:104:5:104:8 | data |
 edges
 | tst.js:5:9:5:27 | foo | tst.js:6:5:6:7 | foo |
 | tst.js:5:9:5:27 | foo | tst.js:6:5:6:7 | foo |
@@ -67,6 +72,10 @@ edges
 | tst.js:90:5:90:12 | data.foo | tst.js:90:5:90:12 | data.foo |
 | tst.js:92:9:92:16 | data.foo | tst.js:92:9:92:16 | data.foo |
 | tst.js:98:9:98:16 | data.foo | tst.js:98:9:98:16 | data.foo |
+| tst.js:103:9:103:29 | data | tst.js:104:5:104:8 | data |
+| tst.js:103:9:103:29 | data | tst.js:104:5:104:8 | data |
+| tst.js:103:16:103:29 | req.query.data | tst.js:103:9:103:29 | data |
+| tst.js:103:16:103:29 | req.query.data | tst.js:103:9:103:29 | data |
 #select
 | tst.js:6:5:6:7 | foo | tst.js:5:15:5:27 | req.query.foo | tst.js:6:5:6:7 | foo | Potential type confusion as $@ may be either an array or a string. | tst.js:5:15:5:27 | req.query.foo | this HTTP request parameter |
 | tst.js:8:5:8:7 | foo | tst.js:5:15:5:27 | req.query.foo | tst.js:8:5:8:7 | foo | Potential type confusion as $@ may be either an array or a string. | tst.js:5:15:5:27 | req.query.foo | this HTTP request parameter |
@@ -80,3 +89,4 @@ edges
 | tst.js:90:5:90:12 | data.foo | tst.js:90:5:90:12 | data.foo | tst.js:90:5:90:12 | data.foo | Potential type confusion as $@ may be either an array or a string. | tst.js:90:5:90:12 | data.foo | this HTTP request parameter |
 | tst.js:92:9:92:16 | data.foo | tst.js:92:9:92:16 | data.foo | tst.js:92:9:92:16 | data.foo | Potential type confusion as $@ may be either an array or a string. | tst.js:92:9:92:16 | data.foo | this HTTP request parameter |
 | tst.js:98:9:98:16 | data.foo | tst.js:98:9:98:16 | data.foo | tst.js:98:9:98:16 | data.foo | Potential type confusion as $@ may be either an array or a string. | tst.js:98:9:98:16 | data.foo | this HTTP request parameter |
+| tst.js:104:5:104:8 | data | tst.js:103:16:103:29 | req.query.data | tst.js:104:5:104:8 | data | Potential type confusion as $@ may be either an array or a string. | tst.js:103:16:103:29 | req.query.data | this HTTP request parameter |

javascript/ql/test/query-tests/Security/CWE-843/tst.js

@@ -101,6 +101,7 @@ express().get('/foo', function (req, res) {
 
 express().get('/foo', function (req, res) {
     let data = req.query.data;
+    data.indexOf(); // NOT OK
     if (Array.isArray(data)) {
         data.indexOf(); // OK
     } else {