title: Checkmarx Cross-Site-Scripting improper sanitization or validation for user input for the params element in Nodejs
body: <p>I'm trying to do resolve the checkmarx scan report for my code.
  The error says something like:</p>
  <blockquote>
  <p>Method <code>async</code> at line 32 of <code>Controller\criteriaController.js</code> gets user input for the params element.<br />
  This element’s value then flows through the code without being properly sanitized or validated and is eventually displayed to the user in method <code>async</code> at line 37 of <code>Controller\criteriaController.js</code>.<br />
  This may enable a <em>Cross-Site-Scripting</em> attack.</p>
  </blockquote>
  <p>I am using <code>celebrate</code> package and properly doing validation using <code>Joi</code> and <code>celebrate</code> methods.</p>
  <p>I am not able to resolve this, kindly help me for some insights.
  Below are my code snippets:</p>
  <pre class="lang-js prettyprint-override"><code>exports.createSettings = async (req, res, next) =&gt; {
    try {
      const { auth, params, body } = req;
      const { userId } = auth || {};
      const { appId, projectId, settingId } = params || {};
      const { appClientId, type } = body;
      await processCreation({ appId, projectId, settingId, body, userId });
      res.send({
        status: 'Success',
        code: 200,
        data: await retrievePlans({
          appId,
          projectId,
          appClientId,
          type,
        }),
      });
    } catch (err) {
      console.log(err);
      next(err);
    }
  };
  </code></pre>
  <p>This is my route:</p>
  <pre class="lang-js prettyprint-override"><code>route.post(
      '/:appId',
      checkSession,
      celebrate(createPlanSchema.appSchema),
      createPlanSettings,
  );
  </code></pre>
  <p>This is <code>appSchema</code></p>
  <pre class="lang-js prettyprint-override"><code>exports.createPlanCriteriaSchema = {
    clientOnlySchema: {
      params: Joi.object({
        appId: Joi.number().required(),
      }),
      body: Joi.object({
        appId: Joi.number().allow(null, '').empty(['', null]),
        projectId: Joi.number().allow(null, '').empty(['', null]),
        appClientId: Joi.number().allow(null, '').empty(['', null]).default(2),
        type: Joi.number().allow(null, '').empty(['', null]).default(3)
      }),
    },
  }
  </code></pre>