Add input sanitization middleware to prevent stored XSS attacks

BACKEND/middleware/sanitizeInput.js

@@ -0,0 +1,43 @@
+import sanitizeHtml from "sanitize-html";
+
+const sanitizeObject = (obj) => {
+  if (!obj || typeof obj !== "object") return;
+
+  Object.keys(obj).forEach((key) => {
+    const value = obj[key];
+
+    if (typeof value === "string") {
+      obj[key] = sanitizeHtml(value, {
+        allowedTags: [],
+        allowedAttributes: {},
+      }).trim();
+    } else if (Array.isArray(value)) {
+      obj[key] = value.map((item) => {
+        if (typeof item === "string") {
+          return sanitizeHtml(item, {
+            allowedTags: [],
+            allowedAttributes: {},
+          }).trim();
+        }
+
+        if (item && typeof item === "object") {
+          sanitizeObject(item);
+        }
+
+        return item;
+      });
+    } else if (value && typeof value === "object") {
+      sanitizeObject(value);
+    }
+  });
+};
+
+const sanitizeInput = (req, res, next) => {
+  if (req.body) {
+    sanitizeObject(req.body);
+  }
+
+  next();
+};
+
+export default sanitizeInput;

BACKEND/package.json

@@ -29,6 +29,7 @@
     "passport": "^0.7.0",
     "passport-github2": "^0.1.12",
     "passport-google-oauth20": "^2.0.0",
+    "sanitize-html": "^2.17.5",
     "pdfkit": "^0.19.1",
     "serverless-http": "^3.0.0",
     "socket.io": "^4.8.3",

BACKEND/routes/auth.routes.js

@@ -1,6 +1,8 @@
 import express from "express";
 import passport from "../config/passport.js";
 import jwt from "jsonwebtoken";
+import sanitizeInput from "../middleware/sanitizeInput.js";
+
 import User from "../models/user.model.js";
 import {
   registerUser,
@@ -20,7 +22,7 @@ import { loginLimiter, logoutLimiter, registerLimiter, forgotPasswordLimiter, re
 
 const router = express.Router();
 
-router.post("/register",registerLimiter, registerUser);
+router.post("/register",registerLimiter,sanitizeInput, registerUser);
 
 router.post("/login",loginLimiter, loginUser);
 

BACKEND/routes/newsletter.route.js

@@ -1,5 +1,6 @@
 import express from "express";
 import { subscribeNewsletter } from "../controllers/newsletter.controller.js";
+import sanitizeInput from "../middleware/sanitizeInput.js";
 import { newsletterSubscribeLimiter } from "../middleware/rateLimiter.js";
 
 const router = express.Router();