add express.csrf as an CSRF protecting middleware

Author: erik-krogh

javascript/ql/src/Security/CWE-352/MissingCsrfMiddleware.ql

@@ -94,6 +94,8 @@ DataFlow::CallNode csrfMiddlewareCreation() {
     exists(result.getOptionArgument(0, "csrf"))
     or
     callee = DataFlow::moduleMember("lusca", "csrf")
+    or
+    callee = DataFlow::moduleMember("express", "csrf")
   )
 }
 

javascript/ql/test/query-tests/Security/CWE-352/MissingCsrfMiddlewareGood2.js

@@ -73,3 +73,20 @@ var passport = require('passport');
         let newEmail = req.cookies["newEmail"];
     })
 });
+
+(function () {
+
+    var app = express()
+
+    app.use(cookieParser())
+    app.use(passport.authorize({ session: true }))
+
+    // Assume token is being set somewhere
+    app.use(express.csrf({ value: function (request) {
+        return request.headers['x-xsrf-token'];
+    }}));
+
+    app.post('/changeEmail', function (req, res) {
+        let newEmail = req.cookies["newEmail"];
+    })
+});