module.exports = function beforeDevServer(app, _server, _compiler) {
  // GraphQL Server
  app.post('/graphql', graphqlHTTP({ schema }));

  app.post('/bad/graphql', (_req, res, next) => {
    res.json({ data: badSchema });
    next();
  });

  app.get(
    '/graphql',
    graphqlHTTP({
      schema,
    }),
  );

  app.use('/images', express.static(path.join(__dirname, 'images')));

  app.use(
    '/renderExample.js',
    express.static(path.join(__dirname, '../resources/renderExample.js')),
  );
};
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.