npm install express-sanitize-escape
Place this directly after all express.use(bodyParser) middlewares and before any express middleware that accesses query or body parameters, e.g.:
var bodyParser = ;var express = ;var expressSanitized = ;app;app;app; // this line follows app.use(bodyParser.json) or the last body parser middleware
The above sanitizes
req.query. In order to sanitize
req.params as well, pass in an express router or app to
along with the names of the params to sanitize, e.g.:
var express = ;var expressSanitized = ;var router = express;expressSanitized;router;router;
'<script>document.write('cookie monster')</script> download now'
will be sanitized to ' download now'.
< > ' " &
will be escaped to
< > ' " &
This module trusts the dependencies to provide basic persistent XSS risk mitigation. A user of this package should review all packages and make their own decision on security and fitness for purpose.
This module was inspired by express-sanitizer and express-sanitized. The difference here is: This middleware automatically sanitizes post and query values parameter. And automatically html escapes all strings.
- This is a breaking change.
- Change to use exports instead of module exports
- Middleware is now
exports.middleware so app.use(expressSanitized())is now
- Added a function to decode the body
- Added tests for unicode characters
- Added function to sanitize request params of a router
- Added additional test for nested object and an array
- Added chai js for testing
- Added htmlencoding
- Change filer to recurse through all values of the object and sanitize only values that are strings
- Updated docs to express 4.x and new bodyParser middleware
- Added License file
- Initial release
- Patrick Hogan firstname.lastname@example.org - Wrap the sanitizer in an npm package
- Mark Andrews email@example.com* - Wrote the initial express-sanitizer. I forked his library.
Copyright (c) 2016 Finger Food Studios firstname.lastname@example.org, MIT License