Any data that enters your system from outside a trust boundary should be treated as untrusted until proven otherwise. That includes form fields, API payloads, file uploads, headers, cookies, queue ...
You can find the source code organized by chapter under the src folder. Each file has the .js and the .ts extension, so you get both the JavaScript and the Typescript ...