codeql/javascript/ql/test/query-tests/Security/CWE-079/ReflectedXss/tst3.js

var express = require('express');

var app = express();
app.enable('x-powered-by').disable('x-powered-by').get('/', function (req, res) {
  let { p } = req.params;
  res.send(p); // NOT OK
});