express-mongo-sanitize

What is express-mongo-sanitize?

The express-mongo-sanitize npm package is designed to prevent MongoDB Operator Injection attacks by sanitizing user-supplied data. It removes any keys that start with '$' or contain a '.' from objects, which are common vectors for injection attacks.

What are express-mongo-sanitize's main functionalities?

Sanitize Request Body

This feature sanitizes the request body to remove any keys that start with '$' or contain a '.', preventing MongoDB Operator Injection attacks.

const express = require('express');
const mongoSanitize = require('express-mongo-sanitize');

const app = express();

// Middleware to sanitize request body
app.use(express.json());
app.use(mongoSanitize());

app.post('/data', (req, res) => {
  res.send('Data received safely');
});

app.listen(3000, () => {
  console.log('Server is running on port 3000');
});

Sanitize Request Query

This feature sanitizes the request query parameters to remove any keys that start with '$' or contain a '.', replacing them with an underscore ('_').

const express = require('express');
const mongoSanitize = require('express-mongo-sanitize');

const app = express();

// Middleware to sanitize request query
app.use(mongoSanitize.sanitize({
  replaceWith: '_'
}));

app.get('/search', (req, res) => {
  res.send('Query sanitized');
});

app.listen(3000, () => {
  console.log('Server is running on port 3000');
});

Sanitize Request Params

This feature sanitizes the request parameters to remove any keys that start with '$' or contain a '.', and logs a warning when a key is sanitized.

const express = require('express');
const mongoSanitize = require('express-mongo-sanitize');

const app = express();

// Middleware to sanitize request params
app.use(mongoSanitize.sanitize({
  onSanitize: ({ req, key }) => {
    console.warn(`This request[${key}] is sanitized`, req);
  }
}));

app.get('/user/:id', (req, res) => {
  res.send('Params sanitized');
});

app.listen(3000, () => {
  console.log('Server is running on port 3000');
});

Other packages similar to express-mongo-sanitize

mongo-sanitize

The mongo-sanitize package is a lightweight library that removes any keys containing '$' or '.' from objects, similar to express-mongo-sanitize. However, it does not provide middleware for Express applications and must be used manually to sanitize objects.

sanitize

The sanitize package provides a broader range of sanitization functions, including HTML sanitization and SQL injection prevention. While it can be used to sanitize MongoDB queries, it is not specifically designed for MongoDB and does not offer the same focused functionality as express-mongo-sanitize.

validator

The validator package is a library of string validators and sanitizers. It includes functions to escape and sanitize strings, which can be used to prevent injection attacks. However, it does not specifically target MongoDB operator injection and requires more manual implementation compared to express-mongo-sanitize.

README

Express Mongoose Sanitize

Express 4.x middleware which sanitizes user-supplied data to prevent MongoDB Operator Injection.

Installation

npm install express-mongo-sanitize

Usage

Add as a piece of express middleware, before defining your routes.

var express = require('express'),
    bodyParser = require('body-parser'),
    mongoSanitize = require('express-mongo-sanitize');

var app = express();

app.use(bodyParser.urlencoded({extended: true}));
app.use(bodyParser.json());
app.use(mongoSanitize());

What?

This module removes any keys in objects that begin with a $ sign from req.body, req.query or req.params.

Why?

Object keys starting with a $ are reserved for use by MongoDB as operators. Without this sanitization, malicious users could send an object containing a $ operator, which could change the context of a database operation. Most notorious is the $where operator, which can execute arbitrary JavaScript on the database.

The best way to prevent this is to sanitize the received data, and remove any offending keys.

Credits

Inspired by mongo-sanitize.

License

MIT

Changelog

[1.1.0] - 2016-01-13

Added

• The middleware also now sanitizes keys with a .. This is in line with Mongo's reserved operators.