no-user-controlled-render-locals

// Whole request object as locals - VULNERABLE
app.post('/preview', (req, res) => {
  res.render('preview', req.body);
});

// Spread forwards every request key - VULNERABLE
app.get('/newsletter', (req, res) => {
  res.render('newsletter', { ...req.query, generatedAt: Date.now() });
});

// Single assignment does not sanitize - VULNERABLE
const locals = req.body;
res.render('post', locals);

// User-controlled view name - VULNERABLE (path traversal)
res.render(req.query.view);
res.render(`pages/${req.params.name}`);

// Field-picking is THE safe pattern - SAFE
app.post('/preview', (req, res) => {
  res.render('preview', {
    title: String(req.body.title || ''),
    body: String(req.body.body || ''),
    authorName: String(req.body.authorName || 'anonymous'),
  });
});

// Static locals - SAFE
res.render('home', { title: 'Welcome' });

// Allowlisted sanitizer (see options) - SAFE
res.render('post', pick(req.body, ['title', 'body']));

// Fixed view names mapped from input - SAFE
const view = ALLOWED_VIEWS.has(req.query.tab) ? req.query.tab : 'default';

🔒 CWE-73 | Template Object Injection (CWE-73) | HIGH
   Fix: Pick only the fields the template needs into an explicit object literal | https://cwe.mitre.org/data/definitions/73.html

{
  rules: {
    "express-security/no-user-controlled-render-locals": ["error", {
      allowSanitizers: ["pick", "sanitizeLocals"]
    }]
  }
}

res.render('profile', {
  name: String(req.body.name || ''),
  bio: String(req.body.bio || ''),
});

// locals.js
export const pickLocals = (source, fields) =>
  Object.fromEntries(
    fields.filter((f) => f in source).map((f) => [f, String(source[f])]),
  );

// route — with allowSanitizers: ['pickLocals']
res.render('post', pickLocals(req.body, ['title', 'body']));

const VIEWS = { news: 'pages/news', jobs: 'pages/jobs' };
res.render(VIEWS[req.query.tab] ?? 'pages/home');

// ❌ NOT DETECTED - Reassigned later
let locals = {};
locals = req.body;
res.render('post', locals);

// ❌ NOT DETECTED - Locals built elsewhere
function buildLocals(req) {
  return req.body;
}
res.render('post', buildLocals(req));

// ❌ NOT DETECTED - Nested object still user-shaped
res.render('profile', req.body.profile);

// ❌ NOT DETECTED - Computed access
res.render('post', req['body']);