simple dataflow for sensitive name

Author: edvraa

javascript/ql/src/semmle/javascript/security/InsecureCookie.qll

@@ -58,6 +58,8 @@ module Cookie {
         ) and
         regexpMatchAuth(val)
       )
+      or
+      isAuthVariable(expr.getAPredecessor())
     }
 
     /**

javascript/ql/test/query-tests/Security/CWE-1004/CookieWithoutHttpOnly.expected

@@ -15,3 +15,4 @@
 | test_responseCookie.js:84:5:84:43 | res.coo ... ptions) | Cookie attribute 'HttpOnly' is not set to true. |
 | test_responseCookie.js:95:5:95:41 | res.coo ... ptions) | Cookie attribute 'HttpOnly' is not set to true. |
 | test_responseCookie.js:106:5:106:43 | res.coo ... ptions) | Cookie attribute 'HttpOnly' is not set to true. |
+| test_responseCookie.js:117:5:117:40 | res.coo ... ptions) | Cookie attribute 'HttpOnly' is not set to true. |

javascript/ql/test/query-tests/Security/CWE-1004/test_responseCookie.js

@@ -107,6 +107,17 @@ app.get('/a', function (req, res, next) {
     res.end('ok')
 })
 
+app.get('/a', function (req, res, next) {
+    let options = {
+        maxAge: 9000000000,
+        httpOnly: false,
+    }
+    options.httpOnly = false;
+    let blabla = "session"
+    res.cookie(blabla, 'value', options); // BAD, var name likely auth related
+    res.end('ok')
+})
+
 app.get('/a', function (req, res, next) {
     let options = {
         maxAge: 9000000000,