JavaScript: Fix regexes for escaping schemes.

Author: Max Schaefer

javascript/ql/src/Security/CWE-116/DoubleEscaping.ql

@@ -54,11 +54,11 @@ DataFlow::Node getASimplePredecessor(DataFlow::Node nd) {
  * into a form described by regular expression `regex`.
  */
 predicate escapingScheme(string metachar, string regex) {
-  metachar = "&" and regex = "&.*;"
+  metachar = "&" and regex = "&.+;"
   or
-  metachar = "%" and regex = "%.*"
+  metachar = "%" and regex = "%.+"
   or
-  metachar = "\\" and regex = "\\\\.*"
+  metachar = "\\" and regex = "\\\\.+"
 }
 
 /**

javascript/ql/test/query-tests/Security/CWE-116/DoubleEscaping/tst.js

@@ -114,3 +114,12 @@ function encodeQuotes(s) {
 function badWrappedEncode2(s) {
   return encodeQuotes(s).replace(/&/g, "&");
 }
+
+function roundtrip(s) {
+  return JSON.parse(JSON.stringify(s));
+}
+
+// dubious, but out of scope for this query
+function badRoundtrip(s) {
+  return s.replace(/\\\\/g, "\\").replace(/\\/g, "\\\\");
+}