I am using axios lib in express middleware for getting response from API's
router.post(someurl,req,res)
{
axios
.get(someurl)
.then((response=>{
**res.send(response.data);**//contains array object which would be send as a JSON response by send()
}
}
Checkmarx scan reports this as untrusted data and possibly reflected XSS attack since the response.data could be vulnerable. It says : The applications .then() embeds untrusted data in the generated output with send() and the data is embedded straight into the output without proper sanitization or encoding enabling an attacker to inject malicious code.
How to overcome this issue since the UI renders the array response to render list. or if we can encode the array object which can be rendered back as response?
JSON.stringify(response.data) worked for me.