@apolitical/server 2.9.0 → 2.10.0-draco.0

package/CHANGELOG.md

@@ -5,6 +5,15 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [2.10.0] - 2023-04-24
+### Added
+- `sanitiseInput` method to request helpers
+- XSS package
+
+## [2.9.1] - 2023-01-31
+### Added
+- Renovate config file
+
 ## [2.9.0] - 2023-01-10
 ### Changed
 - Bump dependencies to keep the project up-to-date

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@apolitical/server",
-  "version": "2.9.0",
+  "version": "2.10.0-draco.0",
   "description": "Node.js module to encapsulate Apolitical's express server setup",
   "author": "Apolitical Group Limited <engineering@apolitical.co>",
   "license": "MIT",
@@ -45,7 +45,8 @@
     "passport-jwt": "4.0.1",
     "prerender-node": "3.5.0",
     "qs": "6.11.0",
-    "swagger-ui-express": "4.6.0"
+    "swagger-ui-express": "4.6.0",
+    "xss": "1.0.14"
   },
   "devDependencies": {
     "@apolitical/eslint-config": "2.1.0",

package/src/config.js

@@ -24,6 +24,15 @@ module.exports = {
     },
     DOCUMENTATION: '/docs/',
   },
+  HELPERS: {
+    SANITISATION: {
+      DEFAULT_XSS_OPTIONS: {
+        whiteList: {}, // Disable all HTML tags and attributes
+        stripIgnoreTag: true, // Remove any remaining HTML content
+        stripIgnoreTagBody: ['script'], // Remove script tags and their content
+      },
+    },
+  },
   MIDDLEWARES: {
     PERMISSIONS: {
       ADMIN_ROLE,

package/src/container.js

@@ -21,6 +21,7 @@ const passportJwt = require('passport-jwt');
 const prerender = require('prerender-node');
 const qs = require('qs');
 const swaggerUi = require('swagger-ui-express');
+const xss = require('xss');
 // Internal Modules
 const apoliticalLogger = require('@apolitical/logger');
 // Configuration
@@ -77,6 +78,7 @@ container.register({
   prerender: asValue(prerender),
   qs: asValue(qs),
   swaggerUi: asValue(swaggerUi),
+  xss: asValue(xss),
   // Internal Modules
   apoliticalLogger: asValue(apoliticalLogger),
   // Configuration

package/src/helpers/request.helper.js

@@ -1,11 +1,16 @@
 'use strict';
 
 module.exports =
-  ({ qs, jwtEncodeHelper, config }) =>
+  ({ qs, jwtEncodeHelper, config, xss }) =>
   ({ sessionSecret = null } = {}) => {
     const {
-      APOLITICAL: { ISSUER, ADMIN_ROLE, COOKIE_KEY },
-    } = config.JWT;
+      JWT: {
+        APOLITICAL: { ISSUER, ADMIN_ROLE, COOKIE_KEY },
+      },
+      HELPERS: {
+        SANITISATION: { DEFAULT_XSS_OPTIONS },
+      },
+    } = config;
 
     function generateAdminToken() {
       if (!sessionSecret) {
@@ -55,5 +60,10 @@ module.exports =
       return queryString ? `?${queryString}` : '';
     }
 
-    return { buildOptions, buildQueryString };
+    function sanitiseInput(input = {}, options = DEFAULT_XSS_OPTIONS) {
+      const sanitizedInput = JSON.parse(xss(JSON.stringify(input), options));
+      return sanitizedInput || {};
+    }
+
+    return { buildOptions, buildQueryString, sanitiseInput };
   };