Implement request sanitizer middleware

Author: qhanson55

app/app.ts

@@ -9,6 +9,7 @@ import { randomBytes } from 'crypto';
 
 import { version as appVersion } from './package.json';
 import { getLogger, httpLogger } from './src/components/log';
+import { requestSanitizer } from './src/middleware/requestSanitizer';
 import router from './src/routes';
 import { Problem } from './src/utils';
 import { DEFAULTCORS } from './src/utils/constants/application';
@@ -26,6 +27,7 @@ app.use(compression());
 app.use(cors(DEFAULTCORS));
 app.use(express.json({ limit: config.get('server.bodyLimit') }));
 app.use(express.urlencoded({ extended: true }));
+app.use(requestSanitizer);
 app.set('query parser', 'extended');
 
 app.use((_req, res, next) => {

app/src/middleware/requestSanitizer.ts

@@ -0,0 +1,50 @@
+import type { NextFunction, Request, Response } from 'express';
+
+/**
+ * Removes all NUL characters from a string
+ * @param str The string to sanitize
+ * @returns The sanitized string if it includes NUL character(s), otherwise the original string
+ */
+function stripNullCharactersFromString(str: string): string {
+  // eslint-disable-next-line no-control-regex
+  return str.replace(/\u0000/g, '');
+}
+
+/**
+ * Recursively sanitize JSON-like data (strings, arrays, plain objects)
+ * @param value The value to sanitize
+ * @returns The sanitized value if a string otherwise the original value
+ */
+function sanitize<T>(value: T): T | string {
+  // Strip NUL characters from strings
+  if (typeof value === 'string') return stripNullCharactersFromString(value);
+
+  // Recursively sanitize arrays items
+  if (Array.isArray(value)) {
+    value.forEach((item, index) => {
+      value[index] = sanitize(item);
+    });
+    return value;
+  }
+
+  // Recursively sanitize plain objects
+  if (value && typeof value === 'object') {
+    for (const [k, v] of Object.entries(value)) (value as Record<string, unknown>)[k] = sanitize(v);
+    return value;
+  }
+
+  return value;
+}
+
+/**
+ * Express middleware to sanitize incoming request bodies
+ * @param req The Express request object
+ * @param _res The Express response object
+ * @param next The next middleware function
+ */
+export function requestSanitizer(req: Request, _res: Response, next: NextFunction): void {
+  if (req.body !== undefined) {
+    req.body = sanitize(req.body);
+  }
+  next();
+}

app/tests/unit/middleware/requestSanitizer.spec.ts

@@ -0,0 +1,165 @@
+import express, { Request, Response } from 'express';
+import request from 'supertest';
+
+import { requestSanitizer } from '../../../src/middleware/requestSanitizer';
+
+// A tiny echo route to observe what the handler receives AFTER the sanitizer runs
+function buildApp() {
+  const app = express();
+  // Body parsers (same order you use in app.ts)
+  app.use(express.json());
+  app.use(express.urlencoded({ extended: true }));
+
+  // The sanitizer under test
+  app.use(requestSanitizer);
+
+  // Echo endpoint to inspect sanitized body
+  app.post('/echo', (req: Request, res: Response) => {
+    res.status(200).json(req.body);
+  });
+
+  // GET route (no body)
+  app.get('/ping', (_req, res) => {
+    res.status(200).json({ ok: true });
+  });
+
+  return app;
+}
+
+describe('requestSanitizer middleware', () => {
+  let app: express.Express;
+  beforeEach(() => {
+    app = buildApp();
+  });
+
+  test('removes NUL written as \\0 (octal) inside JSON body', async () => {
+    const res = await request(app).post('/echo').send({ s: 'hello\0world' });
+
+    expect(res.status).toBe(200);
+    expect(res.body).toEqual({ s: 'helloworld' });
+  });
+
+  test('removes NUL written as \\x00 (hex) inside JSON body', async () => {
+    const res = await request(app).post('/echo').send({ s: 'hello\x00world' });
+
+    expect(res.status).toBe(200);
+    expect(res.body).toEqual({ s: 'helloworld' });
+  });
+
+  test('removes NUL written as \\u0000 (unicode escape) inside JSON body', async () => {
+    const res = await request(app).post('/echo').send({ s: 'hello\u0000world' });
+
+    expect(res.status).toBe(200);
+    expect(res.body).toEqual({ s: 'helloworld' });
+  });
+
+  test('removes NUL written as \\u{0} (unicode code point) inside JSON body', async () => {
+    const res = await request(app).post('/echo').send({ s: 'hello\u{0}world' });
+
+    expect(res.status).toBe(200);
+    expect(res.body).toEqual({ s: 'helloworld' });
+  });
+
+  test('strips NULs from flat string fields (application/json)', async () => {
+    const payload = { name: 'a\u0000b\u0000c', city: 'Victoria' };
+
+    const res = await request(app).post('/echo').set('content-type', 'application/json').send(payload);
+
+    expect(res.status).toBe(200);
+    expect(res.body).toEqual({ name: 'abc', city: 'Victoria' });
+  });
+
+  test('recursively strips NULs inside nested objects/arrays', async () => {
+    const payload = {
+      id: 123,
+      meta: {
+        note: 'he\u0000llo',
+        tags: ['x', 'y\u0000', 'z'],
+        nested: [{ a: '1\u0000' }, { b: '2' }]
+      },
+      flags: { active: true, count: 0, nullable: null }
+    };
+
+    const res = await request(app).post('/echo').send(payload);
+
+    expect(res.status).toBe(200);
+    expect(res.body).toEqual({
+      id: 123,
+      meta: {
+        note: 'hello',
+        tags: ['x', 'y', 'z'],
+        nested: [{ a: '1' }, { b: '2' }]
+      },
+      flags: { active: true, count: 0, nullable: null }
+    });
+  });
+
+  test('recursively removes NULs from arrays/objects using mixed notations', async () => {
+    const payload = {
+      arr: ['a\0', 'b\x00', 'c\u0000', 'd\u{0}'],
+      obj: {
+        x: '\0x',
+        y: 'y\x00',
+        z: 'z\u0000',
+        w: 'w\u{0}'
+      }
+    };
+
+    const res = await request(app).post('/echo').send(payload);
+
+    expect(res.status).toBe(200);
+    expect(res.body).toEqual({
+      arr: ['a', 'b', 'c', 'd'],
+      obj: { x: 'x', y: 'y', z: 'z', w: 'w' }
+    });
+  });
+
+  test('does not alter numbers/booleans/null/undefined fields', async () => {
+    const payload = {
+      n: 42,
+      f: false,
+      t: true,
+      nil: null,
+      undef: undefined,
+      s: '\u0000ok\u0000'
+    };
+
+    const res = await request(app).post('/echo').send(payload);
+
+    expect(res.status).toBe(200);
+    expect(res.body).toEqual({ n: 42, f: false, t: true, nil: null, s: 'ok' });
+    expect('undef' in res.body).toBe(false);
+  });
+
+  test('works with application/x-www-form-urlencoded', async () => {
+    const res = await request(app)
+      .post('/echo')
+      .set('content-type', 'application/x-www-form-urlencoded')
+      .send('a=a%00a&b=b&arr=x&arr=y%00');
+
+    expect(res.status).toBe(200);
+    expect(res.body).toEqual({ a: 'aa', b: 'b', arr: ['x', 'y'] });
+  });
+
+  test('GET with no body is a no-op (does not throw)', async () => {
+    const res = await request(app).get('/ping');
+    expect(res.status).toBe(200);
+    expect(res.body).toEqual({ ok: true });
+  });
+
+  test('large strings with no NULs are returned as-is', async () => {
+    const big = 'x'.repeat(10000);
+    const res = await request(app).post('/echo').send({ big });
+
+    expect(res.status).toBe(200);
+    expect(res.body.big).toHaveLength(10000);
+    expect(res.body.big).toBe(big);
+  });
+
+  test('multiple NULs in a single string are all removed', async () => {
+    const res = await request(app).post('/echo').send({ s: '\u0000\u0000A\u0000B\u0000\u0000' });
+
+    expect(res.status).toBe(200);
+    expect(res.body).toEqual({ s: 'AB' });
+  });
+});