Express middleware for the sanitizer module using Caja's HTML Sanitizer and HTML escape using htmlencode.
npm install express-sanitize-escape
``
npm install express-sanitize-escape
Place this directly after all express.use(bodyParser) middlewares and before any express middleware that accesses query or body parameters, e.g.:
`javascript
var bodyParser = require('body-parser');
var express = require('express');
var expressSanitized = require('express-sanitize-escape');
app.use(bodyParser.urlencoded);
app.use(bodyParser.json);
app.use(expressSanitized()); // this line follows app.use(bodyParser.json) or the last body parser middleware
`
The above sanitizes req.body and req.query. In order to sanitize req.params as well, pass in an express router or app to expressSanitized.sanitizeParams,
along with the names of the params to sanitize, e.g.:
`javascript
var express = require('express');
var expressSanitized = require('express-sanitize-escape');
var router = express.router();
expressSanitized.sanitizeParams(router, ['id','name']);
router.get('/:id', function(req, res, next)
{
// req.params.id is now sanitized.
...
});
router.get('/:name', function(req, res, next)
{
// req.params.name is now sanitized.
...
});
`
The string
`javascript`
' download now'
will be sanitized to ' download now'.
and
`
< > ' " &
will be escaped to
This is a basic implementation of Caja-HTML-Sanitizer with the specific purpose of mitigating against persistent XSS risks.
And node-htmlencode to escape all html entities
This module trusts the dependencies to provide basic persistent XSS risk mitigation. A user of this package should review all packages and make their own decision on security and fitness for purpose.
This module was inspired by express-sanitizer and express-sanitized.
The difference here is:
This middleware automatically sanitizes post and query values parameter.
And automatically html escapes all strings.
is now app.use(expressSanitized.middleware())
- Added a function to decode the body - Patrick Hogan
- Mark Andrews <20metresbelow@gmail.com>* - Wrote the initial express-sanitizer. I forked his library.
- Callinize
Copyright (c) 2016 Finger Food Studios