RSTR-XSS-001 — reflected XSS via res.send / res.end / res.write

Summary

An Express handler writes a value from req.body.*, req.query.*, req.params.*, req.cookies.*, or req.headers.* directly into the HTTP response via res.send(...), res.end(...), or res.write(...). An attacker can supply <script>alert(1)</script> (or something less obvious) and the browser will execute it as HTML.

Severity

High.

Languages

JavaScript, TypeScript (and JSX / TSX / .mjs / .cjs).

How to fix it

Send JSON instead of HTML when possible:

res.json({ greeting: req.body.greeting });

Or HTML-escape:

import he from 'he';
res.send(`<p>${he.encode(req.body.greeting)}</p>`);

Don't write a custom escaper — he and similar libraries handle the edge cases (entity references, surrogate pairs, context-specific encoding).

References