Avoid sending unsanitized user input in response

Documentos > Code Analysis > Static Analysis Rules > Avoid sending unsanitized user input in response

This page is not yet available in Spanish. We are working on its translation.
If you have any questions or feedback about our current translation project, feel free to reach out to us!

Metadata

ID: javascript-express/xss-vulnerability

Language: JavaScript

Severity: Warning

Category: Security

CWE: 79

Description

Returning unsanitized user input in a send or write method can increase your application’s risk of cross-site scripting attacks.

Learn More

OWASP Cross-Site Scripting (XSS) Cheatsheet

Non-Compliant Code Examples

app.get("/", (req, res) => {
    res.send(req.body.foo);
    res.send({ title: "foo", message: req.body.foo });
    res.write(req.body.foo);
    res.write({ title: "foo", message: req.body.foo });
})

Compliant Code Examples

app.get("/", (req, res) => {
    res.send("foo");
    res.send({ title: "foo", message: 'foo' });
    res.write("foo");
    res.write({ title: "foo", message: 'foo' });
})