add new endpoint function

[philvarner-snyk]

No description provided.

[philvarner-snyk]

⛔ Snyk checks have failed. 3 issues have been found so far.

Status	Scanner	Critical	High	Medium	Low	Total (3)
⛔	Open Source Security	0	1	1	0	2 issues
✅	Licenses	0	0	0	0	0 issues
⛔	Code Security	0	1	0	0	1 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[philvarner-snyk]

  Cross-site Scripting (XSS)

Unsanitized input from an HTTP parameter flows into send, where it is used to render an HTML page returned to the user. This may result in a Cross-Site Scripting attack (XSS).

Line 27 | CWE-79 | Priority score 850 | Learn more about this vulnerability

Data flow: 14 steps

Step 1 - 7

nodejs-goof/routes/xss-vulnerable.js

Line 23 in f2f3e4e

const userInput = req.query.input || 'No input provided';

Step 8 routes/xss-vulnerable.js#L25

Step 9 routes/xss-vulnerable.js#L30

Step 10 routes/xss-vulnerable.js#L39

Step 11 routes/xss-vulnerable.js#L31

Step 12 routes/xss-vulnerable.js#L25

Step 13 - 14

nodejs-goof/routes/xss-vulnerable.js

Line 27 in f2f3e4e

res.send(html);

---

Commands

• ⚡ To see AI-powered Snyk Agent Fix suggestions, reply with: @snyk /fix. You'll need to refresh the page 🔄

[philvarner-snyk]

@snyk /fix

[philvarner-snyk]

⚡ Snyk Agent Fix suggestion 1 of 5

The original code snippet had a security vulnerability where user input for userInput was sent directly to the end-user without sanitization, potentially allowing for Cross-Site Scripting (XSS) attacks. The amended code changes the response Content-Type to text/plain, ensuring that the output is treated as plain text and not interpreted as HTML or JavaScript by the client. This simple change mitigates the risk of XSS by displaying user input as literal text rather than executable code. The processUserInput function is presumably where input sanitization would occur to prevent secure data from being displayed as hotlinked text, but this snippet doesn't include that logic. generated by AI

Code changes

--- routes/xss-vulnerable.js
+++ routes/xss-vulnerable.js
@@ -24,7 +24,7 @@
 
     const html = processUserInput(userInput, res);
 
-    res.send(html);
+    res.contentType('text/plain').send(html);
 });
 
 function processUserInput(userInput, res) {

Content generated by AI, expires on 2025-12-13 07:09:28 UTC. Refresh the page after running Snyk commands.

Commands

• ⏩ To see another AI-powered fix suggestion - reply with @snyk /fix

• ✅ To apply this fix and create a commit - reply with @snyk /apply 1