diff --git a/server/src/middleware/sanitization.ts b/server/src/middleware/sanitization.ts index be971a298..f191ca6ca 100644 --- a/server/src/middleware/sanitization.ts +++ b/server/src/middleware/sanitization.ts @@ -1,7 +1,9 @@ import type { Request, Response, NextFunction } from "express"; import DOMPurify from "isomorphic-dompurify"; -export const sanitizeInput = (input: any, options = {}) => { +export function sanitizeInput(input: string, options?: object): string; +export function sanitizeInput(input: unknown, options?: object): unknown; +export function sanitizeInput(input: unknown, options = {}): unknown { if (typeof input !== "string") { return input; } @@ -15,9 +17,9 @@ export const sanitizeInput = (input: any, options = {}) => { }; return DOMPurify.sanitize(input, defaultConfig); -}; +} -export const sanitizeObject = (obj: Record, options = {}): Record => { +export const sanitizeObject = (obj: unknown, options = {}): unknown => { if (typeof obj !== "object" || obj === null) { return obj; } @@ -26,7 +28,7 @@ export const sanitizeObject = (obj: Record, options = {}): Record sanitizeObject(item, options)); } - const sanitized: Record = {}; + const sanitized: Record = {}; for (const [key, value] of Object.entries(obj)) { if (typeof value === "string") { sanitized[key] = sanitizeInput(value, options); @@ -52,7 +54,12 @@ export const sanitizeBody = (options = {}): ((req: Request, res: Response, next: export const sanitizeQuery = (options = {}): ((req: Request, res: Response, next: NextFunction) => void) => { return (req: Request, res: Response, next: NextFunction) => { if (req.query && typeof req.query === "object") { - req.query = sanitizeObject(req.query, options); + for (const key of Object.keys(req.query)) { + const value = req.query[key]; + if (typeof value === "string") { + req.query[key] = sanitizeInput(value, options); + } + } } next(); };