How to resolve Stored/Reflected XSS for arguments passed to JS functions in a VF page?

Question

Overview:

I am looking for ways to bypass Stored/Reflected XSS issues that are showing up as part of CheckMarx Scan report for the arguments passed to js functions in a VF Page, given that queries in the controller class are properly sanitised with String.escapeSingleQuotes() method. Following documentations and links are being referred:-

1. Secure Coding Cross Site Scripting | Secure Coding Guide | Salesforce Developers

2. Cross Site Scripting (XSS)

3. apex - How to solve Reflected XSS error in query referenced in my Visualforce Component - Salesforce Stack Exchange

4. visualforce - How to fix the Stored xss error in salesforce - Salesforce Stack Exchange

5. pmd - Apex classes should escape/sanitize Strings obtained from URL parameters: How? - Salesforce Stack Exchange

Below is the js function -

function ShowContactLookup(ctrlid,accountid,addressType,contactMethod)
{   
    lookupwindow = window.open('/apex/ContactLookUpView?usefor=Contact&AccountID='+accountid+'&ctrlid='+ctrlid+'&addressType='+addressType+'&contactMethod='+ contactMethod,'ContactCustomLookup','width=750,height=600,resizable=no,toolbar=no, menubar=no,top=100,left=300,scrollbars=yes');
} 

The following is the VF page code from where the js function is called :-

<apex:commandlink onclick="ShowContactLookup(document.getElementById('{!JSENCODE($Component.pgBlk1.pgBlk1Sec1.addtoSi.addtoAddresses)}').id, '{!JSENCODE(HTMLENCODE(accountId))}', 'ADDTO', 'Email'); return false;">{!$Label.Label_To}</apex:commandlink>                    

Solutions Tried to resolve Stored/Reflected XSS for similar intances of issues (which didn't work) :-

• Tried adding JSENCODE, JSINHTMLENCODE, neither worked.
• To sanitize the accountid parameter in the js function, added following custom logic :

  
    function escapeHTML(str) {
        return str.replace(/[&<>"'\/]/g, function (char) {
            switch (char) {
                case '&':
                    return '&amp;';
                case '<':
                    return '&lt;';
                case '>':
                    return '&gt;';
                case '"':
                    return '&quot;';
                case "'":
                    return '&#39;';
                case '/':
                    return '&#x2F;';
                default:
                    return char;
            }
        });
    }
  

• Implemented DOMPurify js library for HTML sanitization of the accountid parameter which was suggested in the OWASP documentation. OWASP
• Tried the encodeURIComponent method.