JS: Add models-as-data for openapi-backend

[anttiviljami]

Added models-as-data support for openapi-backend, a framework-agnostic Node.js library that routes, validates and authenticates requests from an OpenAPI definition.

Background

I maintain openapi-backend as part of openapi-stack.

• Usage: ~150k weekly npm downloads. Users listed on openapistack.co include IBM, SAP, AWS, Red Hat and Fastly. Open-source projects using it in server code include Etherpad, Mojaloop central-ledger, Red Hat Developer Hub plugins and City of Helsingborg's haffa-backend.
• The model is already in use. It ships as openapistack/openapi-backend-models from openapi-backend-codeql, next to openapi-backend-specific queries. Its CI checks this same model against CodeQL's built-in js/sql-injection query, including a control run that confirms the query misses the flow without it.
• Users are pointed at it from the openapi-backend README and the Security Best Practices docs on openapistack.co.

Upstreaming it means every CodeQL user gets this coverage without extra configuration.

The problem

openapi-backend parses the incoming request itself and passes handlers a context object c, with the request data on c.request (params, query, headers, cookies, requestBody, ...). That object is built inside the library, so no existing source model covers it, and flows like this aren't found:

api.register('getPet', (c) => db.query(`SELECT * FROM pets WHERE id = ${c.request.params.id}`));

The model

c.request becomes a remote source in every handler openapi-backend calls with a context: operation handlers, security handlers, lifecycle handlers and validate predicates. That covers handlers registered:

• in the constructor (handlers, securityHandlers, validate)
• with register(name, fn), register({ ... }), registerHandler() and registerSecurityHandler()
• on the awaited result of init()
• as TypeScript functions typed (c: Context) => ...

The type names follow the library's real exports (OpenAPIBackend, Handler, Context), so TypeScript annotations match as described in customizing library models for JavaScript.

Checklist

• Change note in javascript/ql/lib/change-notes/ (minorAnalysis, library pack)
• Tests: one case per registration style in the existing CWE-089/untyped SQL injection tests, using inline expectations, including a parameterised query that stays unflagged
• .expected files generated with codeql test run, purely additive
• No QL changes

Thanks to @sylwia-budzynska from GitHub Security Lab for advising on this contribution!

[Copilot]

Copilot review overview

🟡 Changes recommended

The new validate and registerHandler model paths lack direct regression coverage.

Review effort: Balanced
Findings: 2

Open (2)

• Add coverage for validate callback path · New
• Add direct registerHandler API coverage · New

What changed in this PR

Adds models-as-data support for treating openapi-backend request contexts as remote input sources.

Changes:

• Models constructors, initialization, handler registration, and typed contexts.
• Adds SQL-injection fixtures and generated expectations.
• Documents the analysis improvement.

File	Description
javascript/​ql/​lib/​ext/​openapi-backend.model.yml	Defines framework type and source models.
javascript/​ql/​lib/​change-notes/​2026-09-30-openapi-backend.md	Adds the library change note.
javascript/​ql/​test/​query-tests/​Security/​CWE-089/​untyped/​openapi-backend.js	Tests JavaScript handler flows.
javascript/​ql/​test/​query-tests/​Security/​CWE-089/​untyped/​openapi-backend-typed.ts	Tests typed context flow.
javascript/​ql/​test/​query-tests/​Security/​CWE-089/​untyped/​DatabaseAccesses.expected	Updates generated database-access results.
javascript/​ql/​test/​query-tests/​Security/​CWE-089/​untyped/​SqlInjection.expected	Updates generated SQL-injection results.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.