Language: TypeScript
Label: safe
CWE: CWE-287 \u2014 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Code:
function constructUpstreamRequestUrl(
  requestPath: string,
  queryParams?: Record<string, string>,
): string {
  const requestUrl = new URL(upstreamUrl);
  requestUrl.pathname = path.join(requestUrl.pathname, requestPath);
  requestUrl.searchParams.set('version', upstreamRequestVersion);
  for (const key in queryParams) {
    requestUrl.searchParams.set(key, queryParams[key]);
  }
  return requestUrl.toString();
}