JS: Add GuardedRouteHandler access path component

[asgerf]

Adds a new MaD token called GuardedRouteHandler which goes from a middleware function installed in an HTTP router framework to all route handlers guarded by it.

For example

  const express = require('express')
  const app = express()

  app.use(require('@example/middleware').injectData())

  app.get('/foo', (req, res) => {
    req.data; // found by '@example/middleware'; Member[injectData].ReturnValue.GuardedRouteHandler.Parameter[0].Member[data]
  });

The immediate motivation for this is to support this use-case

For testing purposes, I temporarily included this test commit, and ran this evaluation. It shows good performance and some new taint sources were found (based on the model from the test commit).

[Copilot]

Pull Request Overview

This PR introduces a new MaD token named GuardedRouteHandler to enable middleware to inject data into guarded route handlers. It adds new test definitions in the YAML file to map the token and provides a new test file to validate access to the injected data both before and after middleware installation.

Reviewed Changes

Copilot reviewed 2 out of 5 changed files in this pull request and generated no comments.

File	Description
javascript/ql/test/library-tests/frameworks/data/test.ext.yml	Added two new token mappings for GuardedRouteHandler parameters.
javascript/ql/test/library-tests/frameworks/data/guardedRouteHandler.js	Created a new test file to verify data injection behavior before and after middleware installation.

Files not reviewed (3)

• docs/codeql/codeql-language-guides/customizing-library-models-for-javascript.rst: Language not supported
• javascript/ql/lib/semmle/javascript/frameworks/data/internal/ApiGraphModelsSpecific.qll: Language not supported
• javascript/ql/test/library-tests/frameworks/data/test.expected: Language not supported

Comments suppressed due to low confidence (2)

javascript/ql/test/library-tests/frameworks/data/guardedRouteHandler.js:16

• [nitpick] The property name 'injectedReqData' in this test differs from the documented example that uses 'data'. If this is intentional, consider adding a comment to explain the distinction; if not, update the property name for consistency.

    sink(req.injectedReqData); // NOT OK

javascript/ql/test/library-tests/frameworks/data/guardedRouteHandler.js:20

• [nitpick] The property name 'injectedResData' differs from what is shown in the documented example. For consistency and clarity, consider aligning the naming or adding a comment to clarify why different names are used.

    sink(res.injectedResData); // NOT OK

Tip: If you use Visual Studio Code, you can request a review from Copilot before you push from the "Source Control" tab. Learn more

[Napalys]

LGTM, probably would be good if @erik-krog would review as well.

[Napalys]

Maybe it would be helpful to provide an example of what happens to this after adding such MaD?

app.post('/email', (req, res) => {
    req.data;
} 

[erik-krogh]

The example above covers that?

[asgerf]

We had a quick chat about this; @Napalys wanted to highlight that it works for both .get and .post handlers. But since the model doesn't mention anything about get I don't think it's necessary.