some organizations need to authenticate with HTML entities

[ElectricNroff]

Sending

{"short_name": "AT&T", "name": "AT&T Corporation"}

to the POST /api/org endpoint results in a response containing

"short_name":"AT&T"

because of "escape()" in

cve-services/src/controller/org.controller/index.js

Line 155 in b083cfe

body(['short_name']).isString().trim().escape().notEmpty().isLength({ min: CONSTANTS.MIN_SHORTNAME_LENGTH, max: CONSTANTS.MAX_SHORTNAME_LENGTH }),

It's unclear why escape() is being used - there is no documentation stating that some parts of API responses are supposed to be interpreted as HTML. Use of escape() complicates how this CNA would authenticate to CVE Services. They need to send

CVE-API-ORG: AT&T

However, in the pathname component of an API URL, they are required to use AT%26T and cannot use AT%26amp%3BT instead. For example, they could access the /api/org/AT%26T endpoint.

[jdaigneau5]

Related to #729

[jdaigneau5]

We'll be replacing express-validator's escape() with encodeURI because this will resolve issues with ' and &s. Should be done alongside #962