Cross-Site Scripting (XSS) via Response
Description
Detects user input flowing into HTTP responses without proper encoding or sanitization.
What Shoulder detects
How to fix
Use template engines with auto-escaping or sanitize user input before output.
```javascript
const sanitizeHtml = require('sanitize-html');
const clean = sanitizeHtml(userInput);
res.send(`<div>${clean}</div>`);
```
Learn more: https://shoulder.dev/learn/javascript/cwe-79/xss
Applies to
Languages
Frameworks
nodejs
express
fastify
koa
hapi
nestjs
lambda
serverless
graphql
References
Scan for this issue
Detect with Shoulder CLI
npx @shoulderdev/cli trust --rule=javascript-xss .
Real-world examples
Known CVEs in the Cross-Site Scripting (XSS) vulnerability class that this rule helps detect.