codeql/javascript/ql/test/query-tests/Security/CWE-073/routes.js

exports.foo = function(req, res) {
    res.render('foo', req.body); // $ Alert
}