@naturalcycles/nodejs-lib 12.45.1 → 12.47.2

package/dist/index.d.ts

@@ -64,5 +64,6 @@ import { AnySchemaTyped, ArraySchemaTyped, BooleanSchemaTyped, NumberSchemaTyped
 import { anyObjectSchema, anySchema, arraySchema, oneOfSchema, binarySchema, booleanDefaultToFalseSchema, booleanSchema, dateStringSchema, emailSchema, baseDBEntitySchema, savedDBEntitySchema, idSchema, integerSchema, ipAddressSchema, numberSchema, objectSchema, percentageSchema, semVerSchema, SEM_VER_PATTERN, slugSchema, stringSchema, unixTimestampSchema, urlSchema, userAgentSchema, utcOffsetSchema, verSchema } from './validation/joi/joi.shared.schemas';
 import { JoiValidationError, JoiValidationErrorData } from './validation/joi/joi.validation.error';
 import { convert, getValidationResult, isValid, JoiValidationResult, undefinedIfInvalid, validate } from './validation/joi/joi.validation.util';
-export type { JoiValidationErrorData, JoiValidationResult, ValidationErrorItem, ExtendedJoi, SchemaTyped, AnySchema, AnySchemaTyped, ArraySchemaTyped, BooleanSchemaTyped, NumberSchemaTyped, ObjectSchemaTyped, StringSchemaTyped, IDebug, IDebugger, SlackServiceCfg, SlackMessage, SlackMessageProps, SlackApiBody, SlackMessagePrefixHook, ReadableTyped, WritableTyped, TransformTyped, PipelineFromNDJsonFileOptions, PipelineToNDJsonFileOptions, TransformJsonParseOptions, TransformToNDJsonOptions, TransformMapOptions, TransformMapSyncOptions, NDJSONStreamForEachOptions, TransformOptions, TransformLogProgressOptions, TransformMultiThreadedOptions, WorkerClassInterface, WorkerInput, WorkerOutput, TableDiffOptions, InspectAnyOptions, Got, GetGotOptions, AfterResponseHook, BeforeErrorHook, BeforeRequestHook, AjvValidationOptions, AjvSchemaCfg, AjvValidationErrorData, };
-export { JoiValidationError, validate, getValidationResult, isValid, undefinedIfInvalid, convert, Joi, booleanSchema, booleanDefaultToFalseSchema, stringSchema, numberSchema, integerSchema, percentageSchema, dateStringSchema, arraySchema, binarySchema, objectSchema, oneOfSchema, anySchema, anyObjectSchema, baseDBEntitySchema, savedDBEntitySchema, idSchema, unixTimestampSchema, verSchema, emailSchema, SEM_VER_PATTERN, semVerSchema, userAgentSchema, utcOffsetSchema, ipAddressSchema, slugSchema, urlSchema, processSharedUtil, zipBuffer, gzipBuffer, unzipBuffer, gunzipBuffer, zipString, gzipString, unzipToString, gunzipToString, requireEnvKeys, requireFileToExist, LRUMemoCache, stringId, stringIdAsync, stringIdUnsafe, ALPHABET_NUMBER, ALPHABET_LOWERCASE, ALPHABET_UPPERCASE, ALPHABET_ALPHANUMERIC_LOWERCASE, ALPHABET_ALPHANUMERIC_UPPERCASE, ALPHABET_ALPHANUMERIC, md5, hash, hashAsBuffer, md5AsBuffer, stringToBase64, base64ToString, bufferToBase64, base64ToBuffer, Debug, DebugLogLevel, getSecretMap, setSecretMap, loadSecretsFromEnv, loadSecretsFromJsonFile, removeSecretsFromEnv, secret, secretOptional, memoryUsage, memoryUsageFull, SlackService, slackDefaultMessagePrefixHook, readableCreate, readableFrom, readableFromArray, readableToArray, readableForEach, readableForEachSync, readableMap, readableMapToArray, _pipeline, transformBuffer, ndjsonMap, ndJsonFileRead, ndJsonFileWrite, ndjsonStreamForEach, pipelineFromNDJsonFile, pipelineToNDJsonFile, NDJsonStats, streamToNDJsonFile, transformJsonParse, bufferReviver, transformToNDJson, transformFilter, transformFilterSync, transformMap, transformMapSync, transformMapSimple, transformNoOp, writableForEach, writablePushToArray, transformSplit, transformToString, transformToArray, transformTap, transformLogProgress, transformLimit, writableVoid, writableFork, transformMultiThreaded, BaseWorkerClass, tableDiff, inspectAny, getGot, HTTPError, TimeoutError, _chunkBuffer, Ajv, getAjv, AjvSchema, AjvValidationError, readJsonSchemas, readAjvSchemas, hasColors, };
+import { sanitizeHTML, SanitizeHTMLOptions } from './validation/sanitize.util';
+export type { JoiValidationErrorData, JoiValidationResult, ValidationErrorItem, ExtendedJoi, SchemaTyped, AnySchema, AnySchemaTyped, ArraySchemaTyped, BooleanSchemaTyped, NumberSchemaTyped, ObjectSchemaTyped, StringSchemaTyped, IDebug, IDebugger, SlackServiceCfg, SlackMessage, SlackMessageProps, SlackApiBody, SlackMessagePrefixHook, ReadableTyped, WritableTyped, TransformTyped, PipelineFromNDJsonFileOptions, PipelineToNDJsonFileOptions, TransformJsonParseOptions, TransformToNDJsonOptions, TransformMapOptions, TransformMapSyncOptions, NDJSONStreamForEachOptions, TransformOptions, TransformLogProgressOptions, TransformMultiThreadedOptions, WorkerClassInterface, WorkerInput, WorkerOutput, TableDiffOptions, InspectAnyOptions, Got, GetGotOptions, AfterResponseHook, BeforeErrorHook, BeforeRequestHook, AjvValidationOptions, AjvSchemaCfg, AjvValidationErrorData, SanitizeHTMLOptions, };
+export { JoiValidationError, validate, getValidationResult, isValid, undefinedIfInvalid, convert, Joi, booleanSchema, booleanDefaultToFalseSchema, stringSchema, numberSchema, integerSchema, percentageSchema, dateStringSchema, arraySchema, binarySchema, objectSchema, oneOfSchema, anySchema, anyObjectSchema, baseDBEntitySchema, savedDBEntitySchema, idSchema, unixTimestampSchema, verSchema, emailSchema, SEM_VER_PATTERN, semVerSchema, userAgentSchema, utcOffsetSchema, ipAddressSchema, slugSchema, urlSchema, processSharedUtil, zipBuffer, gzipBuffer, unzipBuffer, gunzipBuffer, zipString, gzipString, unzipToString, gunzipToString, requireEnvKeys, requireFileToExist, LRUMemoCache, stringId, stringIdAsync, stringIdUnsafe, ALPHABET_NUMBER, ALPHABET_LOWERCASE, ALPHABET_UPPERCASE, ALPHABET_ALPHANUMERIC_LOWERCASE, ALPHABET_ALPHANUMERIC_UPPERCASE, ALPHABET_ALPHANUMERIC, md5, hash, hashAsBuffer, md5AsBuffer, stringToBase64, base64ToString, bufferToBase64, base64ToBuffer, Debug, DebugLogLevel, getSecretMap, setSecretMap, loadSecretsFromEnv, loadSecretsFromJsonFile, removeSecretsFromEnv, secret, secretOptional, memoryUsage, memoryUsageFull, SlackService, slackDefaultMessagePrefixHook, readableCreate, readableFrom, readableFromArray, readableToArray, readableForEach, readableForEachSync, readableMap, readableMapToArray, _pipeline, transformBuffer, ndjsonMap, ndJsonFileRead, ndJsonFileWrite, ndjsonStreamForEach, pipelineFromNDJsonFile, pipelineToNDJsonFile, NDJsonStats, streamToNDJsonFile, transformJsonParse, bufferReviver, transformToNDJson, transformFilter, transformFilterSync, transformMap, transformMapSync, transformMapSimple, transformNoOp, writableForEach, writablePushToArray, transformSplit, transformToString, transformToArray, transformTap, transformLogProgress, transformLimit, writableVoid, writableFork, transformMultiThreaded, BaseWorkerClass, tableDiff, inspectAny, getGot, HTTPError, TimeoutError, _chunkBuffer, Ajv, getAjv, AjvSchema, AjvValidationError, readJsonSchemas, readAjvSchemas, hasColors, sanitizeHTML, };

package/dist/index.js

@@ -2,7 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ALPHABET_LOWERCASE = exports.ALPHABET_NUMBER = exports.stringIdUnsafe = exports.stringIdAsync = exports.stringId = exports.LRUMemoCache = exports.requireFileToExist = exports.requireEnvKeys = exports.gunzipToString = exports.unzipToString = exports.gzipString = exports.zipString = exports.gunzipBuffer = exports.unzipBuffer = exports.gzipBuffer = exports.zipBuffer = exports.processSharedUtil = exports.urlSchema = exports.slugSchema = exports.ipAddressSchema = exports.utcOffsetSchema = exports.userAgentSchema = exports.semVerSchema = exports.SEM_VER_PATTERN = exports.emailSchema = exports.verSchema = exports.unixTimestampSchema = exports.idSchema = exports.savedDBEntitySchema = exports.baseDBEntitySchema = exports.anyObjectSchema = exports.anySchema = exports.oneOfSchema = exports.objectSchema = exports.binarySchema = exports.arraySchema = exports.dateStringSchema = exports.percentageSchema = exports.integerSchema = exports.numberSchema = exports.stringSchema = exports.booleanDefaultToFalseSchema = exports.booleanSchema = exports.Joi = exports.convert = exports.undefinedIfInvalid = exports.isValid = exports.getValidationResult = exports.validate = exports.JoiValidationError = void 0;
 exports.transformMapSync = exports.transformMap = exports.transformFilterSync = exports.transformFilter = exports.transformToNDJson = exports.bufferReviver = exports.transformJsonParse = exports.streamToNDJsonFile = exports.NDJsonStats = exports.pipelineToNDJsonFile = exports.pipelineFromNDJsonFile = exports.ndjsonStreamForEach = exports.ndJsonFileWrite = exports.ndJsonFileRead = exports.ndjsonMap = exports.transformBuffer = exports._pipeline = exports.readableMapToArray = exports.readableMap = exports.readableForEachSync = exports.readableForEach = exports.readableToArray = exports.readableFromArray = exports.readableFrom = exports.readableCreate = exports.slackDefaultMessagePrefixHook = exports.SlackService = exports.memoryUsageFull = exports.memoryUsage = exports.secretOptional = exports.secret = exports.removeSecretsFromEnv = exports.loadSecretsFromJsonFile = exports.loadSecretsFromEnv = exports.setSecretMap = exports.getSecretMap = exports.DebugLogLevel = exports.Debug = exports.base64ToBuffer = exports.bufferToBase64 = exports.base64ToString = exports.stringToBase64 = exports.md5AsBuffer = exports.hashAsBuffer = exports.hash = exports.md5 = exports.ALPHABET_ALPHANUMERIC = exports.ALPHABET_ALPHANUMERIC_UPPERCASE = exports.ALPHABET_ALPHANUMERIC_LOWERCASE = exports.ALPHABET_UPPERCASE = void 0;
-exports.hasColors = exports.readAjvSchemas = exports.readJsonSchemas = exports.AjvValidationError = exports.AjvSchema = exports.getAjv = exports.Ajv = exports._chunkBuffer = exports.TimeoutError = exports.HTTPError = exports.getGot = exports.inspectAny = exports.tableDiff = exports.BaseWorkerClass = exports.transformMultiThreaded = exports.writableFork = exports.writableVoid = exports.transformLimit = exports.transformLogProgress = exports.transformTap = exports.transformToArray = exports.transformToString = exports.transformSplit = exports.writablePushToArray = exports.writableForEach = exports.transformNoOp = exports.transformMapSimple = void 0;
+exports.sanitizeHTML = exports.hasColors = exports.readAjvSchemas = exports.readJsonSchemas = exports.AjvValidationError = exports.AjvSchema = exports.getAjv = exports.Ajv = exports._chunkBuffer = exports.TimeoutError = exports.HTTPError = exports.getGot = exports.inspectAny = exports.tableDiff = exports.BaseWorkerClass = exports.transformMultiThreaded = exports.writableFork = exports.writableVoid = exports.transformLimit = exports.transformLogProgress = exports.transformTap = exports.transformToArray = exports.transformToString = exports.transformSplit = exports.writablePushToArray = exports.writableForEach = exports.transformNoOp = exports.transformMapSimple = void 0;
 const ajv_1 = require("ajv");
 exports.Ajv = ajv_1.default;
 const got_1 = require("got");
@@ -189,3 +189,5 @@ Object.defineProperty(exports, "getValidationResult", { enumerable: true, get: f
 Object.defineProperty(exports, "isValid", { enumerable: true, get: function () { return joi_validation_util_1.isValid; } });
 Object.defineProperty(exports, "undefinedIfInvalid", { enumerable: true, get: function () { return joi_validation_util_1.undefinedIfInvalid; } });
 Object.defineProperty(exports, "validate", { enumerable: true, get: function () { return joi_validation_util_1.validate; } });
+const sanitize_util_1 = require("./validation/sanitize.util");
+Object.defineProperty(exports, "sanitizeHTML", { enumerable: true, get: function () { return sanitize_util_1.sanitizeHTML; } });

package/dist/stream/pipeline/pipeline.d.ts

@@ -3,4 +3,4 @@ import { pipeline } from 'stream';
 /**
  * Promisified stream.pipeline()
  */
-export declare const _pipeline: typeof pipeline.__promisify__;
+export declare let _pipeline: typeof pipeline.__promisify__;

package/dist/stream/pipeline/pipeline.js

@@ -7,3 +7,9 @@ const util_1 = require("util");
  * Promisified stream.pipeline()
  */
 exports._pipeline = (0, util_1.promisify)(stream_1.pipeline);
+// Workaround https://github.com/nodejs/node/issues/40191
+// todo: remove it when fix is released in 16.x and in AppEngine 16.x
+if (process.version > 'v16.13') {
+    const { pipeline } = require('stream/promises');
+    exports._pipeline = ((streams) => pipeline(...streams));
+}

package/dist/validation/joi/joi.shared.schemas.d.ts

@@ -17,7 +17,7 @@ export declare function oneOfSchema<T = any>(...schemas: AnySchemaTyped<any>[]):
 export declare const anySchema: import("joi").AnySchema;
 export declare const anyObjectSchema: import("joi").ObjectSchema<any>;
 /**
- * [a-z0-9_]*
+ * [a-zA-Z0-9_]*
  * 6-64 length
  */
 export declare const idSchema: import("./string.extensions").ExtendedStringSchema;

package/dist/validation/joi/joi.shared.schemas.js

@@ -28,13 +28,10 @@ exports.anySchema = joi_extensions_1.Joi.any();
 exports.anyObjectSchema = joi_extensions_1.Joi.object().options({ stripUnknown: false });
 // 1g498efj5sder3324zer
 /**
- * [a-z0-9_]*
+ * [a-zA-Z0-9_]*
  * 6-64 length
  */
-exports.idSchema = exports.stringSchema
-    .regex(/^[a-z0-9_]*$/)
-    .min(6)
-    .max(64);
+exports.idSchema = exports.stringSchema.regex(/^[a-zA-Z0-9_]{6,64}$/);
 /**
  * `_` should NOT be allowed to be able to use slug-ids as part of natural ids with `_` separator.
  */
@@ -42,7 +39,7 @@ exports.SLUG_PATTERN = /^[a-z0-9-]*$/;
 /**
  * "Slug" - a valid URL, filename, etc.
  */
-exports.slugSchema = exports.stringSchema.regex(exports.SLUG_PATTERN).min(1).max(255);
+exports.slugSchema = exports.stringSchema.regex(/^[a-z0-9-]{1,255}$/);
 // 16725225600 is 2500-01-01
 exports.unixTimestampSchema = exports.numberSchema.integer().min(0).max(16725225600);
 // 2

package/dist/validation/joi/string.extensions.d.ts

@@ -3,9 +3,18 @@ import * as Joi from 'joi';
 import { AnySchemaTyped } from './joi.model';
 export interface ExtendedStringSchema extends StringSchema, AnySchemaTyped<string> {
     dateString(min?: string, max?: string): this;
+    stripHTML(opt?: JoiStripHTMLOptions): this;
 }
-export interface DateStringParams {
+export interface JoiDateStringOptions {
     min?: string;
     max?: string;
 }
+export interface JoiStripHTMLOptions {
+    /**
+     * 'Strict' would throw an error if it detects any HTML.
+     * Non-strict (default) does not error, but DOES convert the string to the string without HTML.
+     * Internally uses `sanitize-html` library, with allowedTags = [], and method = 'discard'.
+     */
+    strict?: boolean;
+}
 export declare function stringExtensions(joi: typeof Joi): Extension;

package/dist/validation/joi/string.extensions.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.stringExtensions = void 0;
 const time_lib_1 = require("@naturalcycles/time-lib");
+const sanitize = require("sanitize-html");
 function stringExtensions(joi) {
     return {
         type: 'string',
@@ -11,6 +12,7 @@ function stringExtensions(joi) {
             'string.dateStringMin': '"{{#label}}" must be not earlier than {{#min}}',
             'string.dateStringMax': '"{{#label}}" must be not later than {{#max}}',
             'string.dateStringCalendarAccuracy': '"{{#label}}" must be a VALID calendar date',
+            'string.stripHTML': '"{{#label}}" must NOT contain any HTML tags',
         },
         rules: {
             dateString: {
@@ -57,6 +59,7 @@ function stringExtensions(joi) {
                         err = 'string.dateStringMax';
                     }
                     else if (!(0, time_lib_1.dayjs)(v).isValid()) {
+                        // todo: replace with another regex (from ajv-validators) for speed
                         err = 'string.dateStringCalendarAccuracy';
                     }
                     if (err) {
@@ -65,6 +68,39 @@ function stringExtensions(joi) {
                     return v; // validation passed
                 },
             },
+            stripHTML: {
+                method(opt) {
+                    return this.$_addRule({
+                        name: 'stripHTML',
+                        args: {
+                            strict: false,
+                            ...opt,
+                        },
+                    });
+                },
+                args: [
+                    {
+                        name: 'strict',
+                        ref: true,
+                        assert: v => typeof v === 'boolean',
+                        message: 'must be a boolean',
+                    },
+                ],
+                validate(v, helpers, args) {
+                    // console.log('!!! stripHTML', args, v)
+                    const r = sanitize(v, {
+                        allowedTags: [],
+                        // disallowedTagsMode: 'discard' // discard is default
+                        parser: {
+                            decodeEntities: false, // prevent decoding/changing of &<>"'
+                        },
+                    });
+                    if (args.strict && r !== v) {
+                        return helpers.error('string.stripHTML', args);
+                    }
+                    return r; // return converted value (or the same, if there was nothing to sanitize)
+                },
+            },
         },
     };
 }

package/dist/validation/sanitize.util.d.ts

@@ -0,0 +1,8 @@
+import * as sanitize from 'sanitize-html';
+export declare type SanitizeHTMLOptions = sanitize.IOptions;
+/**
+ * Simply a wrapper around `sanitize-html` library.
+ *
+ * @experimental
+ */
+export declare function sanitizeHTML(s: string, opt?: SanitizeHTMLOptions): string;

package/dist/validation/sanitize.util.js

@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.sanitizeHTML = void 0;
+const sanitize = require("sanitize-html");
+/**
+ * Simply a wrapper around `sanitize-html` library.
+ *
+ * @experimental
+ */
+function sanitizeHTML(s, opt) {
+    return sanitize(s, opt);
+}
+exports.sanitizeHTML = sanitizeHTML;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@naturalcycles/nodejs-lib",
-  "version": "12.45.1",
+  "version": "12.47.2",
   "scripts": {
     "prepare": "husky install",
     "docs-serve": "vuepress dev docs",
@@ -17,6 +17,7 @@
     "@naturalcycles/js-lib": "^14.0.0",
     "@naturalcycles/time-lib": "^3.0.1",
     "@types/lru-cache": "^5.1.0",
+    "@types/sanitize-html": "^2.5.0",
     "@types/through2-concurrent": "^2.0.0",
     "ajv": "^8.6.2",
     "ajv-formats": "^2.1.0",
@@ -35,6 +36,7 @@
     "lru-cache": "^6.0.0",
     "move-file": "^2.0.0",
     "nanoid": "^3.0.0",
+    "sanitize-html": "^2.5.2",
     "supports-color": "^8.0.0",
     "through2-concurrent": "^2.0.0",
     "yargs": "^17.0.0"

package/src/index.ts

@@ -172,6 +172,7 @@ import {
   undefinedIfInvalid,
   validate,
 } from './validation/joi/joi.validation.util'
+import { sanitizeHTML, SanitizeHTMLOptions } from './validation/sanitize.util'
 
 export type {
   JoiValidationErrorData,
@@ -219,6 +220,7 @@ export type {
   AjvValidationOptions,
   AjvSchemaCfg,
   AjvValidationErrorData,
+  SanitizeHTMLOptions,
 }
 
 export {
@@ -349,4 +351,5 @@ export {
   readJsonSchemas,
   readAjvSchemas,
   hasColors,
+  sanitizeHTML,
 }

package/src/stream/pipeline/pipeline.ts

@@ -1,7 +1,16 @@
 import { pipeline } from 'stream'
 import { promisify } from 'util'
 
+type AnyStream = NodeJS.ReadableStream | NodeJS.WritableStream | NodeJS.ReadWriteStream
+
 /**
  * Promisified stream.pipeline()
  */
-export const _pipeline = promisify(pipeline)
+export let _pipeline = promisify(pipeline)
+
+// Workaround https://github.com/nodejs/node/issues/40191
+// todo: remove it when fix is released in 16.x and in AppEngine 16.x
+if (process.version > 'v16.13') {
+  const { pipeline } = require('stream/promises')
+  _pipeline = ((streams: AnyStream[]) => pipeline(...streams)) as any
+}

package/src/validation/joi/joi.shared.schemas.ts

@@ -42,13 +42,10 @@ export const anyObjectSchema = Joi.object().options({ stripUnknown: false })
 
 // 1g498efj5sder3324zer
 /**
- * [a-z0-9_]*
+ * [a-zA-Z0-9_]*
  * 6-64 length
  */
-export const idSchema = stringSchema
-  .regex(/^[a-z0-9_]*$/)
-  .min(6)
-  .max(64)
+export const idSchema = stringSchema.regex(/^[a-zA-Z0-9_]{6,64}$/)
 
 /**
  * `_` should NOT be allowed to be able to use slug-ids as part of natural ids with `_` separator.
@@ -58,7 +55,7 @@ export const SLUG_PATTERN = /^[a-z0-9-]*$/
 /**
  * "Slug" - a valid URL, filename, etc.
  */
-export const slugSchema = stringSchema.regex(SLUG_PATTERN).min(1).max(255)
+export const slugSchema = stringSchema.regex(/^[a-z0-9-]{1,255}$/)
 
 // 16725225600 is 2500-01-01
 export const unixTimestampSchema = numberSchema.integer().min(0).max(16725225600)

package/src/validation/joi/string.extensions.ts

@@ -1,17 +1,28 @@
 import { dayjs } from '@naturalcycles/time-lib'
 import { Extension, StringSchema } from 'joi'
 import * as Joi from 'joi'
+import * as sanitize from 'sanitize-html'
 import { AnySchemaTyped } from './joi.model'
 
 export interface ExtendedStringSchema extends StringSchema, AnySchemaTyped<string> {
   dateString(min?: string, max?: string): this
+  stripHTML(opt?: JoiStripHTMLOptions): this
 }
 
-export interface DateStringParams {
+export interface JoiDateStringOptions {
   min?: string
   max?: string
 }
 
+export interface JoiStripHTMLOptions {
+  /**
+   * 'Strict' would throw an error if it detects any HTML.
+   * Non-strict (default) does not error, but DOES convert the string to the string without HTML.
+   * Internally uses `sanitize-html` library, with allowedTags = [], and method = 'discard'.
+   */
+  strict?: boolean
+}
+
 export function stringExtensions(joi: typeof Joi): Extension {
   return {
     type: 'string',
@@ -21,13 +32,14 @@ export function stringExtensions(joi: typeof Joi): Extension {
       'string.dateStringMin': '"{{#label}}" must be not earlier than {{#min}}',
       'string.dateStringMax': '"{{#label}}" must be not later than {{#max}}',
       'string.dateStringCalendarAccuracy': '"{{#label}}" must be a VALID calendar date',
+      'string.stripHTML': '"{{#label}}" must NOT contain any HTML tags',
     },
     rules: {
       dateString: {
         method(min?: string, max?: string) {
           return this.$_addRule({
             name: 'dateString',
-            args: { min, max } as DateStringParams,
+            args: { min, max } as JoiDateStringOptions,
           })
         },
         args: [
@@ -44,7 +56,7 @@ export function stringExtensions(joi: typeof Joi): Extension {
             message: 'must be a string',
           },
         ],
-        validate(v: string, helpers, args: DateStringParams) {
+        validate(v: string, helpers, args: JoiDateStringOptions) {
           // console.log('dateString validate called', {v, args})
 
           let err: string | undefined
@@ -67,6 +79,7 @@ export function stringExtensions(joi: typeof Joi): Extension {
           } else if (max && v > max) {
             err = 'string.dateStringMax'
           } else if (!dayjs(v).isValid()) {
+            // todo: replace with another regex (from ajv-validators) for speed
             err = 'string.dateStringCalendarAccuracy'
           }
 
@@ -77,6 +90,42 @@ export function stringExtensions(joi: typeof Joi): Extension {
           return v // validation passed
         },
       },
+      stripHTML: {
+        method(opt?: JoiStripHTMLOptions) {
+          return this.$_addRule({
+            name: 'stripHTML',
+            args: {
+              strict: false,
+              ...opt,
+            },
+          })
+        },
+        args: [
+          {
+            name: 'strict',
+            ref: true,
+            assert: v => typeof v === 'boolean',
+            message: 'must be a boolean',
+          },
+        ],
+        validate(v: string, helpers, args: JoiStripHTMLOptions) {
+          // console.log('!!! stripHTML', args, v)
+
+          const r = sanitize(v, {
+            allowedTags: [], // no html tags allowed at all
+            // disallowedTagsMode: 'discard' // discard is default
+            parser: {
+              decodeEntities: false, // prevent decoding/changing of &<>"'
+            },
+          })
+
+          if (args.strict && r !== v) {
+            return helpers.error('string.stripHTML', args)
+          }
+
+          return r // return converted value (or the same, if there was nothing to sanitize)
+        },
+      },
     },
   }
 }

package/src/validation/sanitize.util.ts

@@ -0,0 +1,12 @@
+import * as sanitize from 'sanitize-html'
+
+export type SanitizeHTMLOptions = sanitize.IOptions
+
+/**
+ * Simply a wrapper around `sanitize-html` library.
+ *
+ * @experimental
+ */
+export function sanitizeHTML(s: string, opt?: SanitizeHTMLOptions): string {
+  return sanitize(s, opt)
+}