JavaScript: Address review comments.

Author: Max Schaefer

javascript/ql/src/Security/CWE-754/examples/UnvalidatedDynamicMethodCall.js

@@ -12,5 +12,6 @@ var actions = {
 
 app.get('/perform/:action/:payload', function(req, res) {
   let action = actions[req.params.action];
+  // BAD: `action` may not be a function
   res.end(action(req.params.payload));
 });

javascript/ql/src/Security/CWE-754/examples/UnvalidatedDynamicMethodCallGood.js

@@ -2,16 +2,17 @@ var express = require('express');
 var app = express();
 
 var actions = new Map();
-actions.put("play", function (data) {
+actions.put("play", function play(data) {
   // ...
 });
-actions.put("pause", function(data) {
+actions.put("pause", function pause(data) {
   // ...
 });
 
 app.get('/perform/:action/:payload', function(req, res) {
   if (actions.has(req.params.action)) {
     let action = actions.get(req.params.action);
+    // GOOD: `action` is either the `play` or the `pause` function from above
     res.end(action(req.params.payload));
   } else {
     res.end("Unsupported action.");

javascript/ql/src/Security/CWE-754/examples/UnvalidatedDynamicMethodCallGood2.js

@@ -14,6 +14,7 @@ app.get('/perform/:action/:payload', function(req, res) {
   if (actions.hasOwnProperty(req.params.action)) {
     let action = actions[req.params.action];
     if (typeof action === 'function') {
+      // GOOD: `action` is an own method of `actions`
       res.end(action(req.params.payload));
       return;
     }