perfect-express-sanitizer

perfect express sanitizer

A complete package to control user input data to prevent Cross Site Scripting (XSS) ,Sql injection and no Sql injection attack.

it can control body, query and header of the requests and clear all dirty stuff that might effect on functionally of the application.

Installation

Install via NPM:

npm install perfect-express-sanitizer

Usage

simple usage

control input base on your requirements.

const sanitizer = require("perfect-express-sanitizer");

app.use(sanitizer.clean({
    xss: true,
    noSql: true,
    sql: true
}));

advance usage

use white list for some routes that you want to skip ignore

const whiteList = ['/users', '/users/list', '/users/search?age'];

app.use(sanitizer.clean({
    xss: true,
    noSql: true,
    sql: true
}, whiteList));

Levels

setting level from 1 to 5 for sql or nosql sanitizer.

higher level contain lower level policies and check more keywords why define different level? sometimes you need to check only general keywords and all of your routes or some of them sending query or you don't need to set entire policies for them at this point you can set proper level for your application, higher level suggested.

const sanitizer = require("perfect-express-sanitizer");

app.use(sanitizer.clean({
    xss: true,
    noSql: true,
    sql: true,
    sqlLevel: 5,
    noSqlLevel: 5
}));

you can add options to specify allowed keys to be skipped at sanitization

app.use(sanitizer.clean({
    xss: true,
    noSql: true,
    sql: true,
    sqlLevel: 5,
    noSqlLevel: 5,
    allowedKeys: ['name']
}));

you can add options to specify allowed tags to sanitize it and remove other tags

app.use(sanitizer.clean({
    xss: true,
    noSql: true,
    sql: true,
    sqlLevel: 5,
    noSqlLevel: 5,
    allowedKeys: ['h1']
}));

Usage as method

const perfectExpressSanitizer = require("perfect-express-sanitizer");

console.log(perfectExpressSanitizer.sanitize("<script>alert('test')</script>", { xss: true, noSql: true, sql: true, level: 5 }));

License

This project is licensed under the terms of the MIT license