Avoid sending unsanitized user input in response

문서 > 코드 분석 > Static Analysis Rules > Avoid sending unsanitized user input in response

이 페이지는 아직 한국어로 제공되지 않으며 번역 작업 중입니다. 번역에 관한 질문이나 의견이 있으시면 언제든지 저희에게 연락해 주십시오.

Metadata

ID: javascript-express/xss-vulnerability

Language: JavaScript

Severity: Warning

Category: Security

CWE: 79

Description

Returning unsanitized user input in a send or write method can increase your application’s risk of cross-site scripting attacks.

Learn More

OWASP Cross-Site Scripting (XSS) Cheatsheet

Non-Compliant Code Examples

app.get("/", (req, res) => {
    res.send(req.body.foo);
    res.send({ title: "foo", message: req.body.foo });
    res.write(req.body.foo);
    res.write({ title: "foo", message: req.body.foo });
})

Compliant Code Examples

app.get("/", (req, res) => {
    res.send("foo");
    res.send({ title: "foo", message: 'foo' });
    res.write("foo");
    res.write({ title: "foo", message: 'foo' });
})