JS: Add DeepResourceExhaustion test

Author: asgerf

javascript/ql/test/query-tests/Security/CWE-400/DeepObjectResourceExhaustion/DeepObjectResourceExhaustion.expected

@@ -0,0 +1,8 @@
+nodes
+| tst.js:9:29:9:36 | req.body |
+| tst.js:9:29:9:36 | req.body |
+| tst.js:9:29:9:36 | req.body |
+edges
+| tst.js:9:29:9:36 | req.body | tst.js:9:29:9:36 | req.body |
+#select
+| tst.js:9:29:9:36 | req.body | tst.js:9:29:9:36 | req.body | tst.js:9:29:9:36 | req.body | Denial of service caused by processing user input from $@ with $@. | tst.js:9:29:9:36 | req.body | here | tst.js:4:21:4:35 | allErrors: true | allErrors: true |

javascript/ql/test/query-tests/Security/CWE-400/DeepObjectResourceExhaustion/DeepObjectResourceExhaustion.qlref

@@ -0,0 +1 @@
+Security/CWE-400/DeepObjectResourceExhaustion.ql

javascript/ql/test/query-tests/Security/CWE-400/DeepObjectResourceExhaustion/tst.js

@@ -0,0 +1,12 @@
+import express from 'express';
+import Ajv from 'ajv';
+
+let ajv = new Ajv({ allErrors: true });
+ajv.addSchema(require('./input-schema'), 'input');
+
+var app = express();
+app.get('/user/:id', function(req, res) {
+	if (!ajv.validate('input', req.body)) { // NOT OK
+		return;
+	}
+});