JS: Added support for missing axios methods

[Napalys]

This pull request introduces support for the previously missing axios methods and features:

• postForm
• putForm
• patchForm
• getUri
• create
• interceptors.request
• interceptors.response

[Copilot]

Pull Request Overview

This PR extends axios support by adding new methods and interceptor features, along with corresponding test cases and model updates for security-related scenarios.

• Introduces axios interceptors for request and response to simulate SSRF and DOM-based XSS vulnerabilities in test files.
• Adds test cases for new axios methods including postForm, putForm, patchForm, getUri, and create.
• Updates the axios model and change notes to document the inclusion of these new features.

Reviewed Changes

Copilot reviewed 5 out of 10 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
javascript/ql/test/experimental/Security/CWE-918/interceptors.js	Implements a request interceptor that replaces the URL with a user-supplied value (for SSRF test purposes).
javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/interceptors.js	Implements a response interceptor that injects response data into the DOM (for DOM-based XSS test purposes), but contains a use of an undeclared variable.
javascript/ql/lib/ext/axios.model.yml	Adds model definitions for the new axios interceptors.
javascript/ql/test/library-tests/frameworks/ClientRequests/tst.js	Adds tests covering the newly introduced axios methods and axios instance functionality.
javascript/ql/lib/change-notes/2025-03-24-axios-additional-methods.md	Updates documentation to reflect support for additional axios methods and interceptor features.

Files not reviewed (5)

• javascript/ql/lib/semmle/javascript/frameworks/ClientRequests.qll: Language not supported
• javascript/ql/test/experimental/Security/CWE-918/SSRF.expected: Language not supported
• javascript/ql/test/library-tests/frameworks/ClientRequests/ClientRequests.expected: Language not supported
• javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/Xss.expected: Language not supported
• javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/XssWithAdditionalSources.expected: Language not supported

Tip: Copilot code review supports C#, Go, Java, JavaScript, Markdown, Python, Ruby and TypeScript, with more languages coming soon. Learn more