Express Mongoose Sanitize
Express 4.x middleware which sanitizes user-supplied data to prevent MongoDB Operator Injection.
npm install express-mongo-sanitize
Add as a piece of express middleware, before defining your routes.
const express = ;const bodyParser = ;const mongoSanitize = ;const app = ;app;app;// To remove data, use:app;// Or, to replace prohibited characters with _, use:app
You can also bypass the middleware and use the module directly:
const mongoSanitize = ;const payload = ...;// Remove any keys containing prohibited charactersmongoSanitize;// Replace any prohibited characters in keysmongoSanitize;// Check if the payload has keys with prohibited charactersconst hasProhibited = mongoSanitize;
This module searches for any keys in objects that begin with a
$ sign or contain a
req.params. It can then either:
- completely remove these keys and associated data from the object, or
- replace the prohibited characters with another allowed character.
The behaviour is governed by the passed option,
replaceWith. Set this option to have the sanitizer replace the prohibited characters with the character passed in.
See the spec file for more examples.
Object keys starting with a
$ or containing a
. are reserved for use by MongoDB as operators. Without this sanitization, malicious users could send an object containing a
$ operator, or including a
., which could change the context of a database operation. Most notorious is the
The best way to prevent this is to sanitize the received data, and remove any offending keys, or replace the characters with a 'safe' one.
Inspired by mongo-sanitize.