Report showing XSS vulnerability even though the code is fixed.

[mahammadrafeek]

const { xss } = require('express-xss-sanitizer');
app.use(xss());

This code removing the html tags and scripts from the request but still the njsscan showing vulnerabilities for the below code.

router.post("/employee/data", async (req, res) => {

 const empData= await prepareEmployeeData(req.body);

 res.setHeader('Content-Type', 'application/pdf');
 res.setHeader('Content-Disposition', 'attachment; filename=result.pdf');
 res.send(empData);

});

[ajinabraham]

This is possibly a false positive, the rule thinks that req.body is reaching the response via res.send(empData);

[mahammadrafeek]

@ajinabraham
Is there any way we can fix it.?