JS: Add test with route handler indirection

Author: asgerf

javascript/ql/test/query-tests/Security/CWE-073/Consistency.expected

@@ -0,0 +1 @@
+| query-tests/Security/CWE-073/routes.js:2 | expected an alert, but found none | NOT OK |  |

javascript/ql/test/query-tests/Security/CWE-073/routes.js

@@ -0,0 +1,3 @@
+exports.foo = function(req, res) {
+    res.render('foo', req.body); // NOT OK
+}

javascript/ql/test/query-tests/Security/CWE-073/tst.js

@@ -27,4 +27,7 @@ function indirect(res, obj) {
     res.render("template", str); // OK 
 
     res.render("template", JSON.parse(str)); // NOT OK
-}
+}
+
+let routes = require('./routes');
+app.post('/foo', routes.foo);