README

express-sanitized

Installation

npm install @aftership/express-sanitized

Usage

Place this directly after express.bodyParser() and before any express middleware that accesses query or body parameters, e.g.:

var express = require('express'),
    expressSanitized = require('express-sanitized');

app.use(express.bodyParser());
app.use(expressSanitized()); // this line follows express.bodyParser()

Output

The string

'<script>document.write('cookie monster')</script> download now'

will be sanitized to ' download now'.

Limitations

This is a basic implementation of Caja-HTML-Sanitizer with the specific purpose of mitigating against persistent XSS risks.

Caveats

This module trusts the dependencies to provide basic persistent XSS risk mitigation. A user of this package should review all packages and make their own decision on security and fitness for purpose.

This module was inspired by express-sanitizer. The difference here is strict laziness. This middleware automatically sanitizes post and query values whereas that module requires you to manually sanitize each parameter.

Changelog

v0.5.1

Initial release

Contributors

Patrick Hogan patrick@callinize.com - Wrap the sanitizer in an npm package
Mark Andrews 20metresbelow@gmail.com* - Wrote the initial express-sanitizer. I forked his library.
Callinize

@aftership/express-sanitized

Usage no npm install needed!