XSS filter only works in query strings

• Used appropriate template for the issue type
• Searched both open and closed issues for duplicates of this issue
• Title adequately and concisely reflects the feature or the bug

Bug Report

Restify Version 4.1.1

Node.js Version 4.9.1

Expected behaviour

xss filter works to clean scripts

Actual behaviour

xss filter only works to clean scripts in query strings

Repro case

use postman to send REST requests, and compare responses

GET https://testhost/xss?<script>alert(73541);</script>

{
"code": "ResourceNotFound",
"message": "/xss does not exist"
}

GET https://testhost/xss/<script>alert(73541);</script>

{
"code": "ResourceNotFound",
"message": "/xss/%3Cscript%3Ealert(73541);%3C/script%3E does not exist"
}

Cause

Insufficient development on previous fixes on #1031 #1032 to #1018

Are you willing and able to fix this?

Yes. I would like to investigate for a sulotion, but I'll be appreciated if someone can have a quickier fix.

Reproduce the two GET requests from the issue with Postman and compare how query-string and path parameters are handled. Read the earlier fixes in #1031, #1032, and #1018 to understand the existing XSS filtering path. Done means scripts in both query strings and URL paths are cleaned consistently without changing the expected ResourceNotFound response.