// XSS — positive fixture. // Vulnerable: echoes raw user input into HTML output without escaping. // Entry: renderPage(userInput) Cap: HTML_ESCAPE // Expected verdict: Confirmed ( echoed) function renderPage(userInput) { process.stdout.write('__NYX_SINK_HIT__\n'); // Unescaped output — script tags pass through verbatim. process.stdout.write('' + userInput + '\n'); } module.exports = { renderPage };