False positive in javascript.express.security.audit.xss.direct-response-write.direct-response-write

[nbrahms]

Describe the bug
This alert should not trigger on non-rendered response types, like JSON.

To Reproduce

Run Semgrep on an express endpoint with:

  router.use(express.json());
  ...
  router.use(..., (_, res) => {
    ...
    res.send({ something: viaUserInput })
  }

Expected behavior
No Semgrep finding

Priority
How important is this to you?

• P0: blocking me from making progress
• P1: this will block me in the near future
• P2: annoying but not blocking me