Merge pull request #2762 from bluewave-labs/security/apply-input-sanitization

Apply Input Sanitization for XSS Protection

server/src/app.js

@@ -9,6 +9,7 @@ import swaggerUi from "swagger-ui-express";
 import { handleErrors } from "./middleware/handleErrors.js";
 import { setupRoutes } from "./config/routes.js";
 import { generalApiLimiter } from "./middleware/rateLimiter.js";
+import { sanitizeBody, sanitizeQuery } from "./utils/sanitization.js";
 
 export const createApp = ({ services, controllers, envSettings, frontendPath, openApiSpec }) => {
 	const allowedOrigin = envSettings.clientHost;
@@ -30,6 +31,11 @@ export const createApp = ({ services, controllers, envSettings, frontendPath, op
 		})
 	);
 	app.use(express.json());
+
+	// Apply input sanitization middleware
+	app.use(sanitizeBody());
+	app.use(sanitizeQuery());
+
 	app.use(
 		helmet({
 			hsts: false,
@@ -37,6 +43,9 @@ export const createApp = ({ services, controllers, envSettings, frontendPath, op
 				useDefaults: true,
 				directives: {
 					upgradeInsecureRequests: null,
+					"script-src": ["'self'", "'unsafe-inline'", "'unsafe-eval'"],
+					"object-src": ["'none'"],
+					"base-uri": ["'self'"],
 				},
 			},
 		})