In general, to fix reflected XSS when echoing user-controlled values like req.url, you should escape or encode the data appropriately for the output context (HTML, attribute, JavaScript, etc.) before sending it in the HTTP response. In Node.js/Express-style code, a common approach is to use a well-known library such as escape-html to HTML-encode characters that could break out of the intended context (<, >, ", ', &, etc.).

For this specific test file, the minimal, non-functional change is to HTML-escape req.url before passing it to res.end. We can do this by importing the escape-html package at the top of tests/unit/adapters/fetch.test.js and then replacing res.end(req.url) on line 374 with res.end(escape(req.url)). This preserves the behavior of echoing back the URL text (now escaped), which is generally sufficient for a test that checks query parameter handling, while eliminating the direct reflection of raw user input. No other behavior in the tests needs to change.

Concretely:

• Add import escape from 'escape-html'; alongside the other imports at the top of tests/unit/adapters/fetch.test.js.
• Change the server handler in the "should support params" test from res.end(req.url) to res.end(escape(req.url)).

In general, to prevent reflected XSS when sending user-controlled data (like req.url) in an HTTP response, you should apply appropriate output encoding for the context (HTML, attribute, JS, etc.), or otherwise ensure the data is safe (e.g., by validation or by returning it as a non-executable content type like text/plain with proper escaping).

For this specific test, the minimal, non‑functional change is to HTML-escape req.url before sending it. The test only checks that the exact string returned by the server matches a specific URL, so we also need to ensure that the test cases that depend on the raw URL either (a) compare against the encoded value, or (b) avoid echoing the URL at all when we don't need its exact value. Here, the params test ('should support params') asserts the raw URL string; we can avoid XSS in that test by ending the response with a constant safe string and only using req.url on the client side (the client already knows what URL it requested). For the 'should get response headers' test, the response body is irrelevant (we only inspect headers), so we can replace res.end(req.url) with a constant safe string. Concretely:

• In the "support params" test, change the server callback from res.end(req.url); to res.end('OK'); and assert against something that does not require the server to echo the URL, e.g., assert on config.url or the request URL actually used (which axios exposes). However, we are constrained to only edit shown snippets and must not assume extra axios config fields beyond those already used. The simplest XSS-free change is to HTML-escape req.url and update the assertion to match that escaped string.
• In the "get response headers" test, replace res.end(req.url); with res.end('OK'); because the body is unused in the test, removing the flow of user input into the response.

To implement this, within tests/unit/adapters/fetch.test.js we will:

1. Add an import for a well-known escaping library such as escape-html.
2. Use escape(req.url) instead of req.url where the echoed value is needed, and adjust the corresponding assertion to expect the escaped value.
3. For the headers test where the body is irrelevant, change res.end(req.url); to res.end('OK');.