v5: how to sanitize req.query?

[thom-nic]

One of the changes in v5 was to make req.query a getter. In v4 I had middleware to sanitize/coerce/set defaults in req.query and now I can no longer do that. Is there any "hack" by which I can regain this capability?

AFAIK, it is still possible to manipulate body, headers, params, etc so it seems inconsistent that only query would be immutable.

[thom-nic]

Update: monkey-patch solution which appears to work; use at your own peril: express5_mutable_query.js

Update again, thanks to a helpful answer on SO I have a solution that only mutates req.query when the validation middleware needs to change it. I updated the gist linked above.

[wesleytodd]

res.locals is the recommended place to store any arbitrary or modified values scoped to the single request/response pair.

[thom-nic]

the recommended place to store any arbitrary or modified values scoped to the single request/response

Really?

res.locals

Use this property to set variables accessible in templates rendered with res.render.

Suggesting that res.locals be a scratchpad for request-scoped data seems dangerous as you could unintentionally leak sensitive information into the rendered response.

In any case, that's not what I want. I want to modify a property on the request, in middleware, before it gets to my handler. This seems like a pretty normal thing to modify the request in middleware.

[krzysdz]

You could also try experimenting with own query parser function, if you need to customise req.query. This is, however, not a middleware and affects whole (sub-)app.

[thom-nic]

@krzysdz thanks, I considered that but it wasn't apparent to me how I could marry the query parsing which happens at the beginning of the HTTP transaction, and my validation middlware which occurs right at my route handler. I got a helpful answer on SO which I think led to an optimal (albeit still a little hacky) solution.