validateQueryParameterNames may allow reflected XSS in older browsers

[ElectricNroff]

cve-services/src/middleware/middleware.js

Lines 222 to 225 in 7f68351

	function validateQueryParameterNames (queryParamNames, validNames) {
	Object.keys(queryParamNames).forEach(k => {
	if (!validNames.includes(k)) {
	throw new Error(`'${k}' is not a valid parameter name.`)

has a potential XSS vulnerability that is easier to exploit than the similar #697 issue, mainly because a forward slash character is easily sent, e.g.,

curl http://127.1:3000/api/cve\?\<script\>alert\(document.domain\)\</script\>=.html

{"error":"BAD_INPUT","message":"Parameters were invalid","details":[{"msg":"'<script>alert(document.domain)</script>' is not a valid parameter name.","param":"","location":"query"}]}

The code to reflect back any /api/cve parameter name (with an arbitrary payload) was added in 65652b5 on 2022-07-15.
Admittedly, the response comes with HTTP headers that may block exploitation except in older Internet Explorer, etc. (see #697 for details).

X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Content-Type: application/json; charset=utf-8

[jdaigneau5]

Use same filter replace message as #697