# express-sanitized

> Express middleware for the sanitizer module using Caja's HTML Sanitizer.

Latest version **0.5.1** (published 2014-09-07) · MIT license · 0 weekly downloads

## Install

```sh
npm install express-sanitized
pnpm add express-sanitized
yarn add express-sanitized
bun add express-sanitized
```

## Health

**Score 18/100 (F)** — status: abandoned.

Positive: has types package; no vulnerabilities.

Warnings: low downloads; no esm support; pre 1.0.

Negative: abandoned; low maintenance score.

## Facts

| | |
|---|---|
| Version | 0.5.1 |
| Published | 2014-09-07 |
| First published | 2014-09-06 |
| Weekly downloads | 0 |
| License | MIT |
| TypeScript types | separate (@types/express-sanitized) |
| Module format | CommonJS |
| Node | * |
| Dependencies | 1 |
| Known vulnerabilities | 0 |
| Install scripts | no |
| GitHub stars | 6 |
| Author | Patrick Hogan |
| Maintainers | callinize |
| Keywords | express, sanitize, sanitization, xss |

## Links

- npm: https://www.npmjs.com/package/express-sanitized
- Repository: https://github.com/askhogan/express-sanitized
- Issues: https://github.com/askhogan/express-sanitized/issues
- npm.io page: https://npm.io/package/express-sanitized

## Dependencies (1)

- [sanitizer](https://npm.io/package/sanitizer.md) 0.1.2

## Recent versions

- 0.5.1 (latest) — 2014-09-07
- 0.5.0 — 2014-09-06
- 1.0.0 — 2014-09-06

## README

# express-sanitized

## Installation

```
npm install express-sanitized
```

## Usage

Place this directly after express.bodyParser() and before any request parameters are used, e.g.:


```javascript
var express = require('express'),
    expressSanitized = require('express-sanitized');

app.use(express.bodyParser());
app.use(expressSanitized()); // this line follows express.bodyParser()

```


## Output

The string 
```javascript
'<script>document.write('cookie monster')</script> download now'
```
will be sanitized to ' download now'.

## Limitations

This is a basic implementation of [Caja-HTML-Sanitizer](https://github.com/theSmaw/Caja-HTML-Sanitizer) with the specific purpose of mitigating against persistent XSS risks. 

## Caveats

This module trusts the dependencies to provide basic persistent XSS risk mitigation. A user of this package should review all packages and make their own decision on security and fitness for purpose. 

This module was inspired by [express-sanitizer](https://www.npmjs.org/package/express-sanitizer).
  The difference here is strict laziness.  This middleware automatically
  sanitizes post and query values whereas that module requires you to manually sanitize each
  parameter.

## Changelog

### v0.5.1
- Initial release

## Contributors

- Patrick Hogan <patrick@callinize.com> - Wrap the sanitizer in an npm package
- [Callinize](http://www.callinize.com)

## License

Copyright (c) 2014 Patrick Hogan <patrick@callinize.com>, MIT License

---
_Source: https://npm.io/package/express-sanitized · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._