48:I[660678,["/_next/static/chunks/13vqyfldau57p.js","/_next/static/chunks/1gbl-dcot4vlq.js","/_next/static/chunks/3w7s_-pxil6pv.js","/_next/static/chunks/3zorfbfh_a_pd.js","/_next/static/chunks/0cnrn8dx8wpm6.js","/_next/static/chunks/2e4udl7tfg2xd.js","/_next/static/chunks/1mbdq0lktamc7.js","/_next/static/chunks/0nq310uz96h4-.js","/_next/static/chunks/2i4xo8xu-dpuk.js","/_next/static/chunks/40fmu66fmb8tm.js","/_next/static/chunks/3vehc-g2atkra.js","/_next/static/chunks/2a4jc680f5x-9.js","/_next/static/chunks/2wyk4b1ao4pa_.js","/_next/static/chunks/1gth09_ur0iam.js","/_next/static/chunks/0ugk39ckud30x.js","/_next/static/chunks/0pp6seif9t0rh.js","/_next/static/chunks/3bhq66ea_v7by.js","/_next/static/chunks/44c_5nh0vyeb5.js","/_next/static/chunks/1jiredr0b6jr_.js","/_next/static/chunks/0r86cplnpkdza.js","/_next/static/chunks/2ghxk472-g0i6.js","/_next/static/chunks/1ra7jqz5hyzln.js","/_next/static/chunks/3gyv3x9gp8vx3.js","/_next/static/chunks/29-rfqnu0sii0.js","/_next/static/chunks/2dk9hti1hh4ut.js","/_next/static/chunks/2l8l4_a9-xhts.js","/_next/static/chunks/1qsa_rj-5yj90.js","/_next/static/chunks/21l8if97n59ys.js","/_next/static/chunks/34y7-26s89h2f.js","/_next/static/chunks/0ojgzwcpt7vsk.js","/_next/static/chunks/2rb4717lofuum.js","/_next/static/chunks/3-906s1ue5fj3.js","/_next/static/chunks/2t_5zfez2-77k.js","/_next/static/chunks/2641m2aqdum9a.js","/_next/static/chunks/37cq5ilstvlk2.js","/_next/static/chunks/1j29bqcxcpyur.js"],"HydrationBoundary"] 47:Tbb3,{"@context":"https://schema.org","@graph":[{"@type":"WebSite","@id":"https://app.codemod.com/registry#website","url":"https://app.codemod.com/registry","name":"Codemod Registry"},{"@type":"Organization","@id":"https://app.codemod.com#org","name":"codemod","url":"https://app.codemod.com","logo":"https://avatars.githubusercontent.com/u/78830094?v=4"},{"@type":"BreadcrumbList","@id":"https://app.codemod.com/registry/@codemod/express-xss-prevention-escape-html#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Registry","item":"https://app.codemod.com/registry"},{"@type":"ListItem","position":2,"name":"@codemod/express-xss-prevention-escape-html","item":"https://app.codemod.com/registry/@codemod/express-xss-prevention-escape-html"}]},{"@type":"WebPage","@id":"https://app.codemod.com/registry/@codemod/express-xss-prevention-escape-html#webpage","url":"https://app.codemod.com/registry/@codemod/express-xss-prevention-escape-html","name":"express-xss-prevention-escape-html - Codemod Registry","description":"Transform Express.js res.send() calls that concatenate user input directly into HTML to use proper HTML escaping to prevent XSS vulnerabilities","isPartOf":{"@id":"https://app.codemod.com/registry#website"},"author":{"@id":"https://app.codemod.com#org"},"breadcrumb":{"@id":"https://app.codemod.com/registry/@codemod/express-xss-prevention-escape-html#breadcrumb"},"mainEntity":{"@id":"https://app.codemod.com/registry/@codemod/express-xss-prevention-escape-html#sourcecode"}},{"@type":"SoftwareSourceCode","@id":"https://app.codemod.com/registry/@codemod/express-xss-prevention-escape-html#sourcecode","name":"@codemod/express-xss-prevention-escape-html","description":"Transform Express.js res.send() calls that concatenate user input directly into HTML to use proper HTML escaping to prevent XSS vulnerabilities","url":"https://app.codemod.com/registry/@codemod/express-xss-prevention-escape-html","publisher":{"@id":"https://app.codemod.com#org"},"image":"https://avatars.githubusercontent.com/u/78830094?v=4","isAccessibleForFree":true,"license":"MIT","version":"0.1.1","keywords":["security","xss","cwe-79","express","html-escape","transformation","vulnerability","prevention"],"datePublished":"2025-10-26 05:15:58.945025+00","dateModified":"2025-11-29 06:20:21.19263+00"},{"@type":"SoftwareApplication","@id":"https://app.codemod.com/registry/@codemod/express-xss-prevention-escape-html#app","name":"express-xss-prevention-escape-html codemod","description":"Transform Express.js res.send() calls that concatenate user input directly into HTML to use proper HTML escaping to prevent XSS vulnerabilities","url":"https://app.codemod.com/registry/@codemod/express-xss-prevention-escape-html","publisher":{"@id":"https://app.codemod.com#org"},"softwareVersion":"0.1.1","applicationCategory":"DeveloperApplication","operatingSystem":"Cross-platform","offers":{"@type":"Offer","price":"0","priceCurrency":"USD","availability":"https://schema.org/InStock"}}]}49:Te26,# Express XSS Prevention - HTML Escaping Codemod [![Security](https://img.shields.io/badge/Security-CWE--79-red)](https://cwe.mitre.org/data/definitions/79.html) This codemod automatically fixes Cross-Site Scripting (XSS) vulnerabilities in Express.js applications by transforming `res.send()` calls that concatenate user input directly into HTML strings. It adds proper HTML escaping using the `escape-html` library to prevent XSS attacks. ## What it fixes Direct concatenation of user input in `res.send()` calls creates XSS vulnerabilities. This codemod identifies these patterns and automatically adds HTML escaping: ### String Concatenation **Before:** ```javascript res.send('

' + userInput + '

'); ``` **After:** ```javascript const escapeHtml = require('escape-html'); res.send('

' + escapeHtml(userInput) + '

'); ``` ### Template Literals **Before:** ```javascript res.send(`

${userName}

`); ``` **After:** ```javascript const escapeHtml = require('escape-html'); res.send(`

${escapeHtml(userName)}

`); ``` ### Complex Patterns **Before:** ```javascript res.send(''); ``` **After:** ```javascript const escapeHtml = require('escape-html'); res.send(''); ``` ## Installation & Usage ```bash # Run directly with npx npx codemod@latest @codemod/express-xss-prevention-escape-html # Or install and run locally npm install -g @codemod/codemod codemod @codemod/express-xss-prevention-escape-html ``` ## What gets transformed ✅ **Transformed:** - `res.send()` calls with HTML content and user variables - String concatenation patterns with HTML tags - Template literals with HTML and variables - Member expressions like `req.query.name`, `req.body.data` - Multiple variables in the same HTML string ❌ **Not transformed:** - Static HTML strings without variables - Already escaped content using `escape-html` or similar - JSON responses (`res.json()`) - Plain text without HTML tags - Status code responses - Test files (`.test.js`, `.spec.js`) ## Security Impact This codemod helps prevent **CWE-79: Cross-site Scripting (XSS)** vulnerabilities by: 1. **Input Sanitization**: Wraps user input in `escapeHtml()` calls 2. **Automatic Import**: Adds `require('escape-html')` when needed 3. **Safe Defaults**: Only transforms risky patterns, preserves safe code 4. **No Double-Escaping**: Detects already escaped content ## Requirements - Node.js application using Express.js - JavaScript or TypeScript files - Will automatically install `escape-html` dependency ## Edge Cases Handled - ✅ Already escaped content (prevents double-escaping) - ✅ Multiple variables in single expression - ✅ Nested member expressions (`req.body.user.name`) - ✅ Mixed string concatenation and template literals - ✅ Existing import statements (preserves order) ## Development ```bash # Clone and test locally git clone cd express-xss-prevention-escape-html # Install dependencies npm install # Run tests npm test # Update test snapshots if needed npm test -- -u ``` ## Security References - [CWE-79: Cross-site Scripting (XSS)](https://cwe.mitre.org/data/definitions/79.html) - [OWASP XSS Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html) - [Express.js Security Best Practices](https://expressjs.com/en/advanced/best-practice-security.html) - [escape-html npm package](https://www.npmjs.com/package/escape-html) ## License MIT 19:[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$47"}}],["$","$L48",null,{"state":{"mutations":[],"queries":[{"state":{"data":{"json":{"id":"3ae603ab-89f0-4219-895b-0e2f64a2ff80","name":"express-xss-prevention-escape-html","displayName":"@codemod/express-xss-prevention-escape-html","description":"Transform Express.js res.send() calls that concatenate user input directly into HTML to use proper HTML escaping to prevent XSS vulnerabilities","scope":"codemod","visibility":"public","downloadCount":29,"executionCount":13,"createdAt":"2025-10-26 05:15:58.945025+00","updatedAt":"2025-11-29 06:20:21.19263+00","latestVersion":"0.1.1","keywords":["security","xss","cwe-79","express","html-escape","transformation","vulnerability","prevention"],"starCount":1,"author":"Codemod Arc","homepage":null,"repository":null,"license":"MIT","access":"public","documentation":null,"bugsUrl":null,"readme":"$49","organization":{"id":"a23e5412-b7c7-435e-ad5a-292e3fe3e6cf","name":"codemod","slug":"codemod","avatarUrl":"https://avatars.githubusercontent.com/u/78830094?v=4"},"owner":{"id":"60be2aab-7f92-4158-b1ba-ee62555b75f0","username":"mohebifar","name":"Mohamad Mohebifar","avatarUrl":"https://avatars.githubusercontent.com/u/6104558?v=4"},"isLegacy":false,"versions":[{"version":{"id":"bf217ea5-89fe-4c0a-a0ae-0e6b067ddd13","packageId":"3ae603ab-89f0-4219-895b-0e2f64a2ff80","version":"0.1.1","description":"Transform Express.js res.send() calls that concatenate user input directly into HTML to use proper HTML escaping to prevent XSS vulnerabilities","manifest":{"name":"@codemod/express-xss-prevention-escape-html","author":"Codemod Arc","license":"MIT","targets":{"versions":{},"languages":["javascript","typescript"],"frameworks":[]},"version":"0.1.1","keywords":["security","xss","cwe-79","express","html-escape","transformation","vulnerability","prevention"],"registry":{"access":"public","visibility":"public"},"workflow":"workflow.yaml","description":"Transform Express.js res.send() calls that concatenate user input directly into HTML to use proper HTML escaping to prevent XSS vulnerabilities","dependencies":[],"schema_version":"1.0"},"checksum":"eb8fad0038a336dbd92e531d760ad7c99aca6b32b56c62a1761ceb655d56057b","size":6766,"downloadUrl":"https://registry-cdn.codemod.com/prod/packages/codemod/express-xss-prevention-escape-html/0.1.1/public.tar.gz","aiGenerated":false,"sourceArchiveS3Key":null,"targets":{"languages":["typescript"],"frameworks":[]},"dependencies":[],"languages":["javascript"],"stepTypes":["js-ast-grep"],"workflowMetadata":{"nodes":[{"id":"apply-transforms","name":"Apply AST Transformations","steps":[{"name":"Scan javascript files and apply XSS prevention fixes","type":"js-ast-grep","language":"javascript"}]}]},"validated":false,"validationErrors":null,"publishedBy":"60be2aab-7f92-4158-b1ba-ee62555b75f0","deprecated":false,"deprecationMessage":null,"downloadCount":22,"cachedTestCases":{"input":"// Complex HTML structures\napp.get('/form', (req, res) => {\n res.send('');\n});\n\n// Multiple variables in concatenation\napp.get('/mixed', (req, res) => {\n const greeting = 'Hello';\n res.send('

' + greeting + ' ' + req.params.name + '

');\n});\n\n// Nested member expressions\napp.post('/data', (req, res) => {\n res.send(`${req.body.user.comment}`);\n});","output":"\nconst escapeHtml = require('escape-html');\n// Complex HTML structures\napp.get('/form', (req, res) => {\n res.send('');\n});\n\n// Multiple variables in concatenation\napp.get('/mixed', (req, res) => {\n const greeting = 'Hello';\n res.send('

' + escapeHtml(greeting) + ' ' + escapeHtml(req.params.name) + '

');\n});\n\n// Nested member expressions\napp.post('/data', (req, res) => {\n res.send(`${escapeHtml(req.body.user.comment)}`);\n});","isValid":true,"examples":[{"name":"complex-html","path":"tests/complex-html","input":"// Complex HTML structures\napp.get('/form', (req, res) => {\n res.send('');\n});\n\n// Multiple variables in concatenation\napp.get('/mixed', (req, res) => {\n const greeting = 'Hello';\n res.send('

' + greeting + ' ' + req.params.name + '

' + escapeHtml(greeting) + ' ' + escapeHtml(req.params.name) + '

');\n});\n\n// Nested member expressions\napp.post('/data', (req, res) => {\n res.send(`${escapeHtml(req.body.user.comment)}`);\n});","filename":"input.js"},{"name":"no-transformation","path":"tests/no-transformation","input":"// Cases that should NOT be transformed\napp.get('/json', (req, res) => {\n res.json({data: req.query.value});\n});\n\n// Plain text without HTML\napp.get('/text', (req, res) => {\n res.send('Plain text: ' + req.query.message);\n});\n\n// Empty res.send()\napp.get('/empty', (req, res) => {\n res.send();\n});","output":"// Cases that should NOT be transformed\napp.get('/json', (req, res) => {\n res.json({data: req.query.value});\n});\n\n// Plain text without HTML\napp.get('/text', (req, res) => {\n res.send('Plain text: ' + req.query.message);\n});\n\n// Empty res.send()\napp.get('/empty', (req, res) => {\n res.send();\n});","filename":"input.js"},{"name":"static-html","path":"tests/static-html","input":"// Static HTML - should NOT be transformed\napp.get('/static', (req, res) => {\n res.send('

Static Content

');\n});\n\n// Already using escapeHtml - should NOT be transformed\nconst escapeHtml = require('escape-html');\napp.get('/safe', (req, res) => {\n res.send('

' + escapeHtml(userInput) + '

');\n});\n\n// JSON response - should NOT be transformed\napp.get('/api/data', (req, res) => {\n res.send(JSON.stringify({message: req.query.msg}));\n});\n\n// Status code only - should NOT be transformed\napp.get('/status', (req, res) => {\n res.send(200);\n});\n\n// No HTML content - should NOT be transformed\napp.get('/plain', (req, res) => {\n res.send('Plain text: ' + req.query.value);\n});","output":"// Static HTML - should NOT be transformed\napp.get('/static', (req, res) => {\n res.send('

Static Content

');\n});\n\n// Already using escapeHtml - should NOT be transformed\nconst escapeHtml = require('escape-html');\napp.get('/safe', (req, res) => {\n res.send('

' + escapeHtml(userInput) + '

');\n});\n\n// JSON response - should NOT be transformed\napp.get('/api/data', (req, res) => {\n res.send(JSON.stringify({message: req.query.msg}));\n});\n\n// Status code only - should NOT be transformed\napp.get('/status', (req, res) => {\n res.send(200);\n});\n\n// No HTML content - should NOT be transformed\napp.get('/plain', (req, res) => {\n res.send('Plain text: ' + req.query.value);\n});","filename":"input.js"},{"name":"string-concatenation","path":"tests/string-concatenation","input":"// Basic string concatenation vulnerability\nconst express = require('express');\nconst app = express();\n\napp.get('/user', (req, res) => {\n const userInput = req.query.name;\n res.send('

' + userInput + '

');\n});\n\n// With member expression\napp.post('/profile', (req, res) => {\n res.send('

Hello ' + req.query.name + '!

');\n});\n\n// Complex concatenation\nfunction renderTitle(response, pageTitle) {\n response.send('' + pageTitle + '');\n}","output":"// Basic string concatenation vulnerability\nconst express = require('express');\nconst escapeHtml = require('escape-html');\n\nconst app = express();\n\napp.get('/user', (req, res) => {\n const userInput = req.query.name;\n res.send('

' + escapeHtml(userInput) + '

');\n});\n\n// With member expression\napp.post('/profile', (req, res) => {\n res.send('

Hello ' + escapeHtml(req.query.name) + '!

');\n});\n\n// Complex concatenation\nfunction renderTitle(response, pageTitle) {\n response.send('' + escapeHtml(pageTitle) + '');\n}","filename":"input.js"},{"name":"template-literals","path":"tests/template-literals","input":"// Template literals with variables\napp.get('/dashboard', (req, res) => {\n const userName = req.body.username;\n res.send(`

${userName}

`);\n});\n\n// Multiple variables in template\napp.get('/welcome', (req, res) => {\n res.send(`${req.body.username}`);\n});\n\n// Complex template\nconst renderWelcome = (res, title) => {\n res.send(`${title}`);\n};","output":"\nconst escapeHtml = require('escape-html');\n// Template literals with variables\napp.get('/dashboard', (req, res) => {\n const userName = req.body.username;\n res.send(`

${escapeHtml(userName)}

`);\n});\n\n// Multiple variables in template\napp.get('/welcome', (req, res) => {\n res.send(`${escapeHtml(req.body.username)}`);\n});\n\n// Complex template\nconst renderWelcome = (res, title) => {\n res.send(`${escapeHtml(title)}`);\n};","filename":"input.js"}]},"defaultWorkflowName":"default","createdAt":"2025-11-29T06:20:21.192Z","updatedAt":"2026-09-05 16:16:01.741756+00"},"publishedBy":{"id":"60be2aab-7f92-4158-b1ba-ee62555b75f0","username":"mohebifar","name":"Mohamad Mohebifar"},"insightsTemplate":{"packageVersionId":"bf217ea5-89fe-4c0a-a0ae-0e6b067ddd13","status":"ready","generatedAt":"2026-07-21T16:00:03.372Z"},"workflows":[{"name":"default","path":"workflow.yaml","description":null,"isDefault":true,"languages":["javascript"],"stepTypes":["js-ast-grep"],"workflowMetadata":{"nodes":[{"id":"apply-transforms","name":"Apply AST Transformations","steps":[{"name":"Scan javascript files and apply XSS prevention fixes","type":"js-ast-grep","language":"javascript"}]}]}}],"packageBehavior":"workflow-only","isBundle":false,"bundleChildren":[],"parentBundles":[]},{"version":{"id":"0cdf7708-ba7d-48bb-bcc3-243e2aeac88e","packageId":"3ae603ab-89f0-4219-895b-0e2f64a2ff80","version":"0.1.0","description":"Transform Express.js res.send() calls that concatenate user input directly into HTML to use proper HTML escaping to prevent XSS vulnerabilities","manifest":{"name":"@codemod/express-xss-prevention-escape-html","author":"Codemod Arc","license":"MIT","targets":{"versions":{},"languages":["javascript","typescript"],"frameworks":[]},"version":"0.1.0","keywords":["security","xss","cwe-79","express","html-escape","transformation","vulnerability","prevention"],"registry":{"access":"public","visibility":"public"},"workflow":"workflow.yaml","description":"Transform Express.js res.send() calls that concatenate user input directly into HTML to use proper HTML escaping to prevent XSS vulnerabilities","dependencies":[],"schema_version":"1.0"},"checksum":"04690244a4f4bdc74bd60782ca60cab226be0872ec60681480a98c0eade909f6","size":4861,"downloadUrl":"https://registry-cdn.codemod.com/prod/packages/codemod/express-xss-prevention-escape-html/0.1.0/public.tar.gz","aiGenerated":false,"sourceArchiveS3Key":null,"targets":{"versions":{},"languages":["javascript","typescript"],"frameworks":[]},"dependencies":[],"languages":["javascript"],"stepTypes":["js-ast-grep"],"workflowMetadata":{"nodes":[{"id":"apply-transforms","name":"Apply AST Transformations","steps":[{"name":"Scan javascript files and apply XSS prevention fixes","type":"js-ast-grep","language":"javascript"}]}]},"validated":true,"validationErrors":null,"publishedBy":"60be2aab-7f92-4158-b1ba-ee62555b75f0","deprecated":false,"deprecationMessage":null,"downloadCount":7,"cachedTestCases":null,"defaultWorkflowName":"default","createdAt":"2025-10-26T05:15:58.945Z","updatedAt":"2026-09-06 12:29:17.899301+00"},"publishedBy":{"id":"60be2aab-7f92-4158-b1ba-ee62555b75f0","username":"mohebifar","name":"Mohamad Mohebifar"},"insightsTemplate":null,"workflows":[{"name":"default","path":"workflow.yaml","description":null,"isDefault":true,"languages":["javascript"],"stepTypes":["js-ast-grep"],"workflowMetadata":{"nodes":[{"id":"apply-transforms","name":"Apply AST Transformations","steps":[{"name":"Scan javascript files and apply XSS prevention fixes","type":"js-ast-grep","language":"javascript"}]}]}}],"packageBehavior":"workflow-only","isBundle":false,"bundleChildren":[],"parentBundles":[]}],"distTags":{"latest":"0.1.1"},"latestPackageBehavior":"workflow-only","cachedTestCases":"$19:1:props:state:queries:0:state:data:json:versions:0:version:cachedTestCases"},"meta":{"values":{"versions.0.version.createdAt":["Date"],"versions.0.insightsTemplate.generatedAt":["Date"],"versions.1.version.createdAt":["Date"]},"referentialEqualities":{"cachedTestCases":["versions.0.version.cachedTestCases"]}}},"dataUpdateCount":1,"dataUpdatedAt":1788978723179,"error":null,"errorUpdateCount":0,"errorUpdatedAt":0,"fetchFailureCount":0,"fetchFailureReason":null,"fetchMeta":null,"isInvalidated":false,"status":"success","fetchStatus":"idle"},"queryKey":[["registry","getPackage"],{"input":{"name":"express-xss-prevention-escape-html","scope":"codemod"},"type":"query"}],"queryHash":"[[\"registry\",\"getPackage\"],{\"input\":{\"name\":\"express-xss-prevention-escape-html\",\"scope\":\"codemod\"},\"type\":\"query\"}]"}]},"children":"$L4a"}]] 1c:null 20:[["$","title","0",{"children":"codemod/express-xss-prevention-escape-html - Codemod Registry"}],["$","meta","1",{"name":"description","content":"Transform Express.js res.send() calls that concatenate user input directly into HTML to use proper HTML escaping to prevent XSS vulnerabilities"}],["$","meta","2",{"name":"author","content":"codemod"}],["$","meta","3",{"name":"keywords","content":"express-xss-prevention-escape-html, codemod, code transformation, automated refactoring, package, registry, security, xss, cwe-79, express, html-escape, transformation, vulnerability, prevention"}],["$","meta","4",{"name":"creator","content":"codemod"}],["$","meta","5",{"name":"publisher","content":"Codemod"}],["$","meta","6",{"name":"robots","content":"index, follow"}],["$","meta","7",{"name":"googlebot","content":"index, follow, max-video-preview:-1, max-image-preview:large, max-snippet:-1"}],["$","meta","8",{"name":"application-name","content":"Codemod Registry"}],["$","meta","9",{"name":"apple-mobile-web-app-title","content":"Codemod"}],["$","meta","10",{"name":"apple-mobile-web-app-capable","content":"yes"}],["$","meta","11",{"name":"apple-mobile-web-app-status-bar-style","content":"default"}],["$","meta","12",{"name":"format-detection","content":"telephone=no"}],["$","meta","13",{"name":"mobile-web-app-capable","content":"yes"}],["$","meta","14",{"name":"msapplication-config","content":"/browserconfig.xml"}],["$","meta","15",{"name":"msapplication-TileColor","content":"#000000"}],["$","meta","16",{"name":"msapplication-tap-highlight","content":"no"}],["$","meta","17",{"name":"theme-color","content":"#000000"}],["$","meta","18",{"name":"viewport","content":"width=device-width, initial-scale=1, maximum-scale=1, user-scalable=no"}],["$","link","19",{"rel":"canonical","href":"https://app.codemod.com/registry/@codemod/express-xss-prevention-escape-html"}],["$","meta","20",{"property":"og:title","content":"codemod/express-xss-prevention-escape-html - Codemod Registry"}],["$","meta","21",{"property":"og:description","content":"Transform Express.js res.send() calls that concatenate user input directly into HTML to use proper HTML escaping to prevent XSS vulnerabilities"}],["$","meta","22",{"property":"og:url","content":"https://app.codemod.com/registry/@codemod/express-xss-prevention-escape-html"}],["$","meta","23",{"property":"og:site_name","content":"Codemod Registry"}],["$","meta","24",{"property":"og:locale","content":"en_US"}],["$","meta","25",{"property":"og:image","content":"https://app.codemod.com/api/og/registry/@codemod/express-xss-prevention-escape-html"}],["$","meta","26",{"property":"og:image:width","content":"1200"}],["$","meta","27",{"property":"og:image:height","content":"630"}],["$","meta","28",{"property":"og:image:alt","content":"express-xss-prevention-escape-html package"}],["$","meta","29",{"property":"og:type","content":"website"}],["$","meta","30",{"name":"twitter:card","content":"summary_large_image"}],["$","meta","31",{"name":"twitter:site","content":"@codemod"}],["$","meta","32",{"name":"twitter:creator","content":"@codemod"}],["$","meta","33",{"name":"twitter:title","content":"codemod/express-xss-prevention-escape-html - Codemod Registry"}],["$","meta","34",{"name":"twitter:description","content":"Transform Express.js res.send() calls that concatenate user input directly into HTML to use proper HTML escaping to prevent XSS vulnerabilities"}],["$","meta","35",{"name":"twitter:image","content":"https://app.codemod.com/api/og/registry/@codemod/express-xss-prevention-escape-html"}]]