WIP

Author: qhanson55

.codeclimate.yml

@@ -9,6 +9,7 @@ import { randomBytes } from 'crypto';
 
 import { version as appVersion } from './package.json';
 import { getLogger, httpLogger } from './src/components/log';
+import { requestSanitizer } from './src/middleware/requestSanitizer';
 import router from './src/routes';
 import { Problem } from './src/utils';
 import { DEFAULTCORS } from './src/utils/constants/application';
@@ -26,6 +27,7 @@ app.use(compression());
 app.use(cors(DEFAULTCORS));
 app.use(express.json({ limit: config.get('server.bodyLimit') }));
 app.use(express.urlencoded({ extended: true }));
+app.use(requestSanitizer());
 app.set('query parser', 'extended');
 
 app.use((_req, res, next) => {

app/app.ts

@@ -0,0 +1,47 @@
+import type { NextFunction, Request, Response } from 'express';
+
+/** Remove all NUL characters from a string. */
+export function stripNullsFromString(input: string): string {
+  // Fast path: avoid allocation when there's nothing to replace
+  return input.indexOf('\u0000') === -1 ? input : input.replace(/[\x00]/g, '');
+}
+
+function isPlainObject(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+
+/**
+ * @function sanitizeDeep
+ * Recursively sanitize JSON-like data (strings, arrays, plain objects).
+ * @param value - The value to sanitize.
+ * @returns The sanitized value.
+ */
+function sanitizeDeep(value: unknown): unknown {
+  // Strip NUL characters from strings
+  if (typeof value === 'string') return stripNullsFromString(value);
+
+  // Recursively sanitize arrays items
+  if (Array.isArray(value)) return value.map(sanitizeDeep);
+
+  // Recursively sanitize plain objects
+  if (typeof value === 'object' && value !== null) {
+    const out: Record<string, unknown> = {};
+    for (const [k, v] of Object.entries(value)) out[k] = sanitizeDeep(v);
+    return out;
+  }
+  return value;
+}
+
+/**
+ * @function requestSanitizer
+ * @description Express middleware to sanitize incoming request bodies.
+ * @param req - The Express request object.
+ * @param _res - The Express response object.
+ * @param next - The next middleware function.
+ */
+export function requestSanitizer(req: Request, _res: Response, next: NextFunction): void {
+  if (typeof req.body !== 'undefined') {
+    req.body = sanitizeDeep(req.body) as typeof req.body;
+  }
+  next();
+}