JS: Improve Express middleware taint tracking

[Napalys]

Improves Express middleware taint tracking by:

• Using getALocalSource() to better handle default value expressions and similar patterns in middleware data flow
• Adding req._parsedUrl as a remote input source

[Copilot]

Pull Request Overview

Implements enhanced taint tracking in Express middleware by leveraging getALocalSource() and adding req._parsedUrl as an input source.

• Introduce a test (serverSide2.js) to validate default-value and _parsedUrl handling.
• Update QL library to recognize _parsedUrl properties and use getALocalSource() in routing analysis.
• Refresh expected outputs and add change notes for these enhancements.

Reviewed Changes

Copilot reviewed 7 out of 5 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
javascript/ql/test/query-tests/Security/CWE-918/serverSide2.js	New test exercising middleware flows with req._parsedUrl and defaults
javascript/ql/test/query-tests/Security/CWE-918/RequestForgery.expected	Updated expected alerts/provenance for the new test
javascript/ql/lib/semmle/javascript/frameworks/Express.qll	Extended remote input source matching to include _parsedUrl
javascript/ql/lib/semmle/javascript/Routing.qll	Added getALocalSource() to the middleware data-flow assignment rule
javascript/ql/lib/change-notes/2025-06-16-middleware-express.md	Documented the middleware taint-tracking improvements

Comments suppressed due to low confidence (2)

javascript/ql/test/query-tests/Security/CWE-918/serverSide2.js:10

• req.parsedQuery is never initialized before assigning to its url property, which will cause a runtime error. Consider adding req.parsedQuery = {} before this line.

  req.parsedQuery.url = req.url || {}; // $Source[js/request-forgery]

javascript/ql/test/query-tests/Security/CWE-918/serverSide2.js:11

• req.SomeObject is undefined when assigning to its url property, leading to a TypeError. Initialize req.SomeObject = {} before this assignment.

  req.SomeObject.url = req.url; // $Source[js/request-forgery]