markau / express-sanitizer Goto Github PK

If I am sanitizing user text input &XYZ&, it gets converted to &XYZ&.

Any pointers on how to fix this?

Hello,

Is it possible to whitelist specific characters from being escaped e.g. prevent "&" from being escaped to "&"?

Thanks

I am getting SyntaxError: Unexpected end of JSON input

Its only if i enter a value like this <HUI. If I put a space between the angle bracket and the word its fine, its only when its one word, no spaces.

My Code:

app.use((req, res, next) => {
  if( req.body ){

    console.log(typeof req.body); //object
    console.log(JSON.stringify(req.body)); // {"obj":"<HUI"}

    let sanitizedBody = req.sanitize(JSON.stringify(req.body));
    console.log(sanitizedBody) // {"obj":"

    // check if bodies differ to send an alert to slack
    if( sanitizedBody != JSON.stringify(req.body) ){
      console.log('Has been sanitised');
    }

    req.body = JSON.parse(sanitizedBody); 
    ^--- error is from this line, because trying to parse a broken object

  }
  next();
});

What are the options for sanitizer?

I'm running into an issue where sanitizer is breaking redirect URLs; what's the best way to handle a URL in a query param (e.g. www.mysite.com/?redirect=/my/ampersands/get/replaced) that's getting encoded from www.redirectExample.com/?ampersands=get&converted=to to www.redirectExample.com/?ampersands=get&converted=to?

Our best thought for a generic solution is to regex for url query params and do a simple find-replace on & but I dunno if there's a cleaner way to go.