Security: Fix reflected cross-site scripting vulnerability (CodeQL #6)

[jmaddington]

Description

A reflected cross-site scripting vulnerability exists where user-provided input is written directly to an HTTP response without proper sanitization.

Location

• File: index.js
• Line: 356

Issue

User input (from an HTTP request) is directly incorporated into the response without proper sanitization or escaping, allowing for a cross-site scripting attack. This is commonly known as reflected XSS.

Recommendation

To fix this issue:

1. Implement proper HTML escaping before writing user input to responses
2. Use a library like escape-html or DOMPurify to sanitize user-provided values
3. Consider implementing Content Security Policy (CSP) headers as an additional defense layer

Example Fix

Replace:

With:

References

• OWASP XSS Prevention Cheat Sheet
• CWE-79: Improper Neutralization of Input During Web Page Generation