Parameter not escaped
In the following code:
const verificationUrl = "https://www.google.com/recaptcha/api/siteverify?secret=" + secretKey + "&response=" + params.body["g-recaptcha-response"] + "&remoteip=" + params.ip
You have to escape the
response parameter (at least). I don't see any exploit for now, but as it is an external value, you should escape it. If the code change, and developers don't pay attention, a bad value could send your secretKey to an attacker.