JS: adjust tests slightly to also support DatabaseAccess testing

Author: esbena

javascript/ql/test/query-tests/Security/CWE-089/untyped/SqlInjection.expected

@@ -70,8 +70,8 @@ nodes
 | mongoose.js:57:21:57:25 | query |
 | mongoose.js:60:25:60:29 | query |
 | mongoose.js:60:25:60:29 | query |
-| mongoose.js:63:24:63:28 | query |
-| mongoose.js:63:24:63:28 | query |
+| mongoose.js:63:21:63:25 | query |
+| mongoose.js:63:21:63:25 | query |
 | mongoose.js:65:32:65:36 | query |
 | mongoose.js:65:32:65:36 | query |
 | mongoose.js:67:27:67:31 | query |
@@ -212,8 +212,8 @@ edges
 | mongoose.js:20:11:20:20 | query | mongoose.js:57:21:57:25 | query |
 | mongoose.js:20:11:20:20 | query | mongoose.js:60:25:60:29 | query |
 | mongoose.js:20:11:20:20 | query | mongoose.js:60:25:60:29 | query |
-| mongoose.js:20:11:20:20 | query | mongoose.js:63:24:63:28 | query |
-| mongoose.js:20:11:20:20 | query | mongoose.js:63:24:63:28 | query |
+| mongoose.js:20:11:20:20 | query | mongoose.js:63:21:63:25 | query |
+| mongoose.js:20:11:20:20 | query | mongoose.js:63:21:63:25 | query |
 | mongoose.js:20:11:20:20 | query | mongoose.js:65:32:65:36 | query |
 | mongoose.js:20:11:20:20 | query | mongoose.js:65:32:65:36 | query |
 | mongoose.js:20:11:20:20 | query | mongoose.js:67:27:67:31 | query |
@@ -257,8 +257,8 @@ edges
 | mongoose.js:21:19:21:32 | req.body.title | mongoose.js:57:21:57:25 | query |
 | mongoose.js:21:19:21:32 | req.body.title | mongoose.js:60:25:60:29 | query |
 | mongoose.js:21:19:21:32 | req.body.title | mongoose.js:60:25:60:29 | query |
-| mongoose.js:21:19:21:32 | req.body.title | mongoose.js:63:24:63:28 | query |
-| mongoose.js:21:19:21:32 | req.body.title | mongoose.js:63:24:63:28 | query |
+| mongoose.js:21:19:21:32 | req.body.title | mongoose.js:63:21:63:25 | query |
+| mongoose.js:21:19:21:32 | req.body.title | mongoose.js:63:21:63:25 | query |
 | mongoose.js:21:19:21:32 | req.body.title | mongoose.js:65:32:65:36 | query |
 | mongoose.js:21:19:21:32 | req.body.title | mongoose.js:65:32:65:36 | query |
 | mongoose.js:21:19:21:32 | req.body.title | mongoose.js:67:27:67:31 | query |
@@ -335,7 +335,7 @@ edges
 | mongoose.js:54:25:54:29 | query | mongoose.js:21:19:21:26 | req.body | mongoose.js:54:25:54:29 | query | This query depends on $@. | mongoose.js:21:19:21:26 | req.body | a user-provided value |
 | mongoose.js:57:21:57:25 | query | mongoose.js:21:19:21:26 | req.body | mongoose.js:57:21:57:25 | query | This query depends on $@. | mongoose.js:21:19:21:26 | req.body | a user-provided value |
 | mongoose.js:60:25:60:29 | query | mongoose.js:21:19:21:26 | req.body | mongoose.js:60:25:60:29 | query | This query depends on $@. | mongoose.js:21:19:21:26 | req.body | a user-provided value |
-| mongoose.js:63:24:63:28 | query | mongoose.js:21:19:21:26 | req.body | mongoose.js:63:24:63:28 | query | This query depends on $@. | mongoose.js:21:19:21:26 | req.body | a user-provided value |
+| mongoose.js:63:21:63:25 | query | mongoose.js:21:19:21:26 | req.body | mongoose.js:63:21:63:25 | query | This query depends on $@. | mongoose.js:21:19:21:26 | req.body | a user-provided value |
 | mongoose.js:65:32:65:36 | query | mongoose.js:21:19:21:26 | req.body | mongoose.js:65:32:65:36 | query | This query depends on $@. | mongoose.js:21:19:21:26 | req.body | a user-provided value |
 | mongoose.js:67:27:67:31 | query | mongoose.js:21:19:21:26 | req.body | mongoose.js:67:27:67:31 | query | This query depends on $@. | mongoose.js:21:19:21:26 | req.body | a user-provided value |
 | mongoose.js:68:8:68:12 | query | mongoose.js:21:19:21:26 | req.body | mongoose.js:68:8:68:12 | query | This query depends on $@. | mongoose.js:21:19:21:26 | req.body | a user-provided value |

javascript/ql/test/query-tests/Security/CWE-089/untyped/mongoose.js

@@ -60,12 +60,12 @@ app.post('/documents/find', (req, res) => {
     Document.updateMany(query);
 
     // NOT OK: query is tainted by user-provided object value
-    Document.updateOne(query);
+	Document.updateOne(query).then(X);
 
-	Document.findByIdAndUpdate(X, query); // NOT OK
+	Document.findByIdAndUpdate(X, query, function(){}); // NOT OK
 
 	new Mongoose.Query(X, Y, query)	// NOT OK
-		.and(query) // NOT OK
+		.and(query, function(){}) // NOT OK
 	;
 
 	Document.where(query)	// NOT OK
@@ -74,5 +74,7 @@ app.post('/documents/find', (req, res) => {
 		.distinct(X, query) // NOT OK
 		.comment(query) // OK
 		.count(query) // NOT OK
+		.exec()
 	;
+
 });