Avoid sending unsanitized user input in response

Metadata

ID: typescript-express/xss-vulnerability

Language: TypeScript

Severity: Warning

Category: Security

Description

Returning unsanitized user input in a send or write method can increase your application’s risk of cross-site scripting attacks.

Learn More

Non-Compliant Code Examples

app.get("/", (req: Request, res: Response) => {
    res.send(req.body.foo);
    res.send({ title: "foo", message: req.body.foo });
    res.write(req.body.foo);
    res.write({ title: "foo", message: req.body.foo });
})

Compliant Code Examples

app.get("/", (req: Request, res: Response) => {
    res.send("foo");
    res.send({ title: "foo", message: 'foo' });
    res.write("foo");
    res.write({ title: "foo", message: 'foo' });
})