@exortek/express-mongo-sanitize v1.0.0

@exortek/express-mongo-sanitize

A middleware designed for sanitizing incoming requests to an Express application, particularly when working with MongoDB (NoSQL). It ensures that certain patterns, such as special characters or malicious input, are removed or replaced from the request body, query, and parameters, preventing potential injection attacks in NoSQL.

Key Features

• Automatic sanitization of potentially dangerous MongoDB operators and special characters.
• Multiple operation modes (auto, manual)
• Customizable sanitization patterns and replacement strategies
• Support for nested objects and arrays
• Configurable string and array handling options
• Skip routes functionality
• Custom sanitizer support
• Email address preservation during sanitization
• Option to remove matched patterns entirely
• Enhanced security with request object cloning

Installation

npm install @exortek/express-mongo-sanitize

OR

yarn add @exortek/express-mongo-sanitize

Usage

Register the middleware in your Express application before defining your routes.

App route example

const express = require('express');
const expressMongoSanitize = require('@exortek/express-mongo-sanitize');

const app = express();

app.use(exppress.json());

// Register the middleware
app.use(expressMongoSanitize());

// Define your routes
app.get('/users', (req, res) => {
  // Your route logic here
});

app.post('/users', (req, res) => {
  // Your route logic here
});

app.listen(3000, () => {
  console.log('Server is running on port 3000');
});

Route-specific example

const express = require('express');
const expressMongoSanitize = require('@exortek/express-mongo-sanitize');
const router = require('./router');

const app = express();

app.use(express.json());

// Register the middleware
app.use(expressMongoSanitize());

// Define your routes
app.use('/api', router);

app.listen(3000, () => {
  console.log('Server is running on port 3000');
});

Configuration Options

The middleware accepts various configuration options to customize its behavior. Here's a detailed breakdown of all available options:

Core Options

String Options

The stringOptions object controls string sanitization behavior:

{
  trim: false,      // Whether to trim whitespace from start/end
  lowercase: false, // Whether to convert strings to lowercase
  maxLength: null   // Maximum allowed string length (null for no limit)
}

Array Options

The arrayOptions object controls array sanitization behavior:

{
  filterNull: false, // Whether to remove null/undefined values
  distinct: false    // Whether to remove duplicate values
}

Example Configuration

Here's an example of how you can configure the middleware with custom options:

app.use(expressMongoSanitize({
    app: app,
    router: router,
    routerBasePath: 'api',
    replaceWith: 'REPLACED',
    removeMatches: false,
    sanitizeObjects: ['body', 'params', 'query'],
    mode: 'auto',
    skipRoutes: ['/health', '/metrics'],
    customSanitizer: (data, options) => {
      // Custom sanitizer logic here
      return data;
    },
    recursive: true,
    removeEmpty: false,
    patterns: [/pattern1/, /pattern2/],
    allowedKeys: ['key1', 'key2'],
    deniedKeys: ['key3', 'key4'],
    stringOptions: {
      trim: true,
      lowercase: true,
      maxLength: 100
    },
    arrayOptions: {
      filterNull: true,
      distinct: true
    }
}));

Notes

• The middleware is designed to work with Express applications and is not compatible with other frameworks.
• If the app or router instances are not provided to the @exortek/express-mongo-sanitize middleware, the route parameters (path variables) cannot be sanitized. The middleware will skip sanitizing the route parameters and display a warning message indicating that sanitization was not performed for the path variables. Ensure that both the app and router instances are properly passed to the middleware to enable route parameter sanitization.
• All options are optional and will use their default values if not specified.
• Custom patterns must be valid RegExp objects

License

MIT

Copyright © 2024 ExorTek