32 lines
672 B
JavaScript
32 lines
672 B
JavaScript
const sanitize = require("sanitize-html");
|
|
|
|
function sanitizeValue(value) {
|
|
if (typeof value === "string") {
|
|
return sanitize(value, {
|
|
allowedTags: [],
|
|
allowedAttributes: {},
|
|
});
|
|
}
|
|
|
|
if (Array.isArray(value)) {
|
|
return value.map(item => sanitizeValue(item));
|
|
}
|
|
|
|
if (value !== null && typeof value === "object") {
|
|
const sanitizedObj = {};
|
|
for (const key in value) {
|
|
sanitizedObj[key] = sanitizeValue(value[key]);
|
|
}
|
|
return sanitizedObj;
|
|
}
|
|
|
|
return value; // numbers, booleans, null
|
|
}
|
|
|
|
module.exports = function sanitizeInput(req, res, next) {
|
|
if (req.body) {
|
|
req.body = sanitizeValue(req.body);
|
|
}
|
|
next();
|
|
};
|