test(types): remove reflected-XSS sink from type-test fixtures

CodeQL reported js/reflected-xss (CWE-79, high) against
tests/types/catchAsync.test-d.ts: two handler bodies passed
`req.params.id` directly to `res.json(...)`. Express serializes a bare
string as the entire response body without escaping `<`, which is the
risk its `json escape` setting exists to mitigate, so a user-controlled
string reaching that sink is a pattern worth removing rather than
suppressing.

The published package was never affected. The flow existed only in a
type-level fixture that is never executed, never registered on a server,
and never published, and dist/ is byte-identical before and after.

The object form `res.json({ id: ... })` used elsewhere in the same file
is not a sink, because reflected XSS requires a string to reach the
response body and the object wrapper breaks that flow.

Both bodies now assert the parameter typing directly instead of echoing
the request. That is a stronger test: the new params-shape assertions pin
the custom `Request<P>` type argument, which `res.json(req.params.id)`
never did, since a `ParamsDictionary` index signature also yields a
string for `.id`.

Author: Sajadlance

CHANGELOG.md

@@ -2,6 +2,10 @@
 
 ## [Unreleased]
 
+### Security
+
+- Removed a reflected-XSS sink (CWE-79) from the type-level test fixtures, reported by CodeQL as `js/reflected-xss`. Two handler bodies passed `req.params.id` straight to `res.json(...)`; Express serializes a bare string as the entire response body without escaping `<`, which is the risk its `json escape` setting exists to mitigate, so a user-controlled string reaching that sink is a genuine pattern to avoid. **The published package was never affected**: the flow existed only in `tests/types/catchAsync.test-d.ts`, a file that is never executed, never registered on a server, and never published (`files: ["dist"]`), and `dist/` is byte-identical before and after this change. The object form `res.json({ id: ... })` used elsewhere in the same file is not a sink, because reflected XSS requires a string to reach the response body. The bodies now assert the parameter typing directly rather than echoing the request, which is a stronger test: the new `params`-shape assertions pin the custom `Request<P>` type argument, which `res.json(req.params.id)` never did, since a `ParamsDictionary` index signature also yields a string for `.id` (`tests/types/catchAsync.test-d.ts`)
+
 ## [0.7.0] - 2026-07-27
 
 ### Changed

tests/types/catchAsync.test-d.ts

@@ -165,14 +165,26 @@ type _retThrowsAsync = Expect<
  * 4. Request / Response type arguments survive the wrapping.
  * ------------------------------------------------------------------------- */
 
+// Handler bodies here never write a request value into the response. Passing a
+// user-controlled string straight to `res.json(...)` is a reflected-XSS sink
+// (CWE-79): Express serializes a bare string as the entire body without escaping
+// `<`, which is why Express ships the `json escape` setting. The wrapping is what
+// these tests are about, so the parameter typing is asserted directly instead.
 const typedParams = catchAsync(
   async (rq: Request<{ id: string }>, rs: Response) => {
-    rs.json(rq.params.id);
+    void rq;
+    rs.json({ ok: true });
   }
 );
 type _paramsSurvive = Expect<
   Equal<Parameters<typeof typedParams>[0], Request<{ id: string }>>
 >;
+// Stronger than the old body: this pins the `params` shape itself, which
+// `rs.json(rq.params.id)` never did, since a `ParamsDictionary` index signature
+// also yields a string for `.id`.
+type _paramsShape = Expect<
+  Equal<Parameters<typeof typedParams>[0]["params"], { id: string }>
+>;
 const asTypedHandler: RequestHandler<{ id: string }> = typedParams;
 void asTypedHandler;
 app.get<{ id: string }>("/typed", typedParams);
@@ -182,12 +194,16 @@ interface IdParams {
 }
 const namedParams = catchAsync(
   async (rq: Request<IdParams>, rs: Response) => {
-    rs.json(rq.params.id);
+    void rq;
+    rs.json({ ok: true });
   }
 );
 type _namedSurvive = Expect<
   Equal<Parameters<typeof namedParams>[0], Request<IdParams>>
 >;
+type _namedShape = Expect<
+  Equal<Parameters<typeof namedParams>[0]["params"], IdParams>
+>;
 
 interface AuthedRequest extends Request {
   user: { id: string };
@@ -464,7 +480,9 @@ void (0 as unknown as [
   _decoratedMethodKeepsSourceArity,
   _mitigationHasFullArity,
   _paramsSurvive,
+  _paramsShape,
   _namedSurvive,
+  _namedShape,
   _subtypeSurvives,
   _errArity,
   _errNot3,