bump express to 5, migrate, bump multer to 2

server/package.json

@@ -45,7 +45,7 @@
 		"dayjs": "^1.11.23",
 		"dockerode": "5.0.0",
 		"dotenv": "^16.4.5",
-		"express": "^4.19.2",
+		"express": "5.2.1",
 		"express-rate-limit": "^8.5.1",
 		"gamedig": "5.2.0",
 		"got": "14.4.7",
@@ -58,11 +58,11 @@
 		"jsonwebtoken": "9.0.2",
 		"mjml": "^5.0.0-alpha.4",
 		"mongoose": "^8.3.3",
-		"multer": "^1.4.5-lts.2",
-		"nodemailer": "9.0.5",
+		"multer": "2.4.0",
+		"nodemailer": "9.1.1",
 		"ping": "0.4.4",
 		"re2": "^1.24.1",
-		"sharp": "0.35.3",
+		"sharp": "0.35.4",
 		"ssl-checker": "2.0.10",
 		"swagger-ui-express": "5.0.1",
 		"tldts": "^7.4.10",

server/src/api/middleware/sanitization.ts

@@ -53,14 +53,10 @@ export const sanitizeBody = (options = {}): ((req: Request, res: Response, next:
 
 export const sanitizeQuery = (options = {}): ((req: Request, res: Response, next: NextFunction) => void) => {
 	return (req: Request, res: Response, next: NextFunction) => {
-		if (req.query && typeof req.query === "object") {
-			for (const key of Object.keys(req.query)) {
-				const value = req.query[key];
-				if (typeof value === "string") {
-					req.query[key] = sanitizeInput(value, options);
-				}
-			}
-		}
+		const sanitized = Object.fromEntries(
+			Object.entries(req.query).map(([key, value]) => [key, typeof value === "string" ? sanitizeInput(value, options) : value])
+		);
+		Object.defineProperty(req, "query", { value: sanitized, writable: true, configurable: true, enumerable: true });
 		next();
 	};
 };

server/src/app.ts

@@ -122,7 +122,7 @@ export const createApp = ({
 	setupRoutes(app, controllers, services);
 
 	// FE routes
-	app.get("*", (req, res) => {
+	app.get("/{*splat}", (req, res) => {
 		res.sendFile(path.join(frontendPath, "index.html"));
 	});
 	app.use(handleErrors(services.logger));

server/test/unit/middleware/sanitization.test.ts

@@ -0,0 +1,107 @@
+import { describe, expect, it, jest } from "@jest/globals";
+import type { NextFunction, Request, Response } from "express";
+import { sanitizeBody, sanitizeInput, sanitizeObject, sanitizeQuery } from "../../../src/api/middleware/sanitization.ts";
+
+// Express 5 exposes req.query as a getter on the request prototype that re-parses the URL on
+// every read, so writes into the returned object are lost. The middleware must shadow the
+// getter with an own property, which is what this fixture checks.
+const makeExpress5Request = (query: Record<string, unknown>) => {
+	const proto = {};
+	Object.defineProperty(proto, "query", {
+		get: () => ({ ...query }),
+		configurable: true,
+		enumerable: true,
+	});
+	return Object.create(proto) as Request;
+};
+
+describe("sanitizeInput", () => {
+	it("strips html tags and keeps the text content", () => {
+		expect(sanitizeInput('<script>alert("x")</script>hello <b>bold</b>')).toBe("hello bold");
+	});
+
+	it("returns non-string values unchanged", () => {
+		expect(sanitizeInput(42)).toBe(42);
+		expect(sanitizeInput(null)).toBeNull();
+		expect(sanitizeInput(undefined)).toBeUndefined();
+	});
+});
+
+describe("sanitizeObject", () => {
+	it("sanitizes nested strings and arrays, leaving other values untouched", () => {
+		const result = sanitizeObject({
+			name: "<img src=x onerror=alert(1)>Alice",
+			count: 3,
+			active: true,
+			items: [{ note: "<i>one</i>" }, { note: "two" }],
+			nested: { note: "<p>hi</p>" },
+		});
+
+		expect(result).toEqual({
+			name: "Alice",
+			count: 3,
+			active: true,
+			items: [{ note: "one" }, { note: "two" }],
+			nested: { note: "hi" },
+		});
+	});
+
+	it("returns primitives and null unchanged", () => {
+		expect(sanitizeObject("<b>x</b>")).toBe("<b>x</b>");
+		expect(sanitizeObject(null)).toBeNull();
+	});
+});
+
+describe("sanitizeBody middleware", () => {
+	it("replaces req.body with a sanitized copy and calls next", () => {
+		const req = { body: { name: "<b>Alice</b>", nested: { note: "<i>x</i>" } } } as unknown as Request;
+		const next = jest.fn() as unknown as NextFunction;
+
+		sanitizeBody()(req, {} as Response, next);
+
+		expect(req.body).toEqual({ name: "Alice", nested: { note: "x" } });
+		expect(next).toHaveBeenCalledWith();
+	});
+
+	it("leaves req.body alone when there is no body", () => {
+		const req = {} as unknown as Request;
+		const next = jest.fn() as unknown as NextFunction;
+
+		sanitizeBody()(req, {} as Response, next);
+
+		expect(req.body).toBeUndefined();
+		expect(next).toHaveBeenCalledWith();
+	});
+});
+
+describe("sanitizeQuery middleware", () => {
+	it("sanitizes string values so that later reads of req.query see them", () => {
+		const req = makeExpress5Request({ filter: "<script>x</script>term", page: "2" });
+		const next = jest.fn() as unknown as NextFunction;
+
+		sanitizeQuery()(req, {} as Response, next);
+
+		expect(req.query).toEqual({ filter: "term", page: "2" });
+		expect(req.query).toEqual({ filter: "term", page: "2" }); // stable across reads
+		expect(next).toHaveBeenCalledWith();
+	});
+
+	it("does not sanitize inside array values", () => {
+		const req = makeExpress5Request({ type: ["<b>http</b>", "ping"] });
+		const next = jest.fn() as unknown as NextFunction;
+
+		sanitizeQuery()(req, {} as Response, next);
+
+		expect(req.query).toEqual({ type: ["<b>http</b>", "ping"] });
+	});
+
+	it("handles an empty query", () => {
+		const req = makeExpress5Request({});
+		const next = jest.fn() as unknown as NextFunction;
+
+		sanitizeQuery()(req, {} as Response, next);
+
+		expect(req.query).toEqual({});
+		expect(next).toHaveBeenCalledWith();
+	});
+});