Express 4.x middleware which sanitizes user input data (in req.body, req.query, req.headers and req.params) to prevent Cross Site Scripting (XSS) attack.
$ npm install express-xss-sanitizerAdd as a piece of express middleware, before defining your routes.
const express = require('express');
const bodyParser = require('body-parser');
const { xss } = require('express-xss-sanitizer');
const app = express();
app.use(bodyParser.json({limit:'1kb'}));
app.use(bodyParser.urlencoded({extended: true, limit:'1kb'}));
app.use(xss());
You can add options to specify allowed keys or allowed attributes to be skipped at sanitization
const options = {
allowedKeys: ['name'],
allowedAttributes: {
input: ['value'],
},
}
app.use(xss(options));
You can add options to specify allowed tags to sanitize it and remove other tags
const options = {
allowedTags: ['h1']
}
app.use(xss(options));
Add as a piece of express middleware, before single route.
const express = require('express');
const bodyParser = require('body-parser');
const { xss } = require('express-xss-sanitizer');
const app = express();
app.use(bodyParser.json({limit:'1kb'}));
app.use(bodyParser.urlencoded({extended: true, limit:'1kb'}));
app.post("/body", xss(), function (req, res) {
// your code
});
app.post("/test", function (req, res) {
// your code
});
You also can sanitize your data (object, array, string,etc) on the fly.
const { sanitize } = require('express-xss-sanitizer');
// ...
data = sanitize(data)
// or
data = sanitize(data, {allowedKeys: ['name']})
// ...
To run the test suite, first install the dependencies, then run npm test:
$ npm install
$ npm testFeel free to open issues on github.