Nest.js - Sanitize request body

user_7307274 0
Viewed 4666

I would like to ask you if nestjs provides some kind of request's body escapeing to prevent XSS attacks.

If it doesn't, is there any "best-practice" to achieve this kind of protection?

Thanks!

nestjs express node.js
2 Answers

Yes, you can use a interceptor to serialize the data in and out your api.

https://docs.nestjs.com/techniques/serialization

And you can use a Sanitize Pipe, just to clean some garbage that comes with your body request based on your parameter type.

import {ArgumentMetadata, Injectable, PipeTransform} from '@nestjs/common';
import {plainToClass} from 'class-transformer';

@Injectable()
export class SanitizePipe implements PipeTransform {

    constructor(private readonly className: any) {}

    transform(value: any, metadata: ArgumentMetadata) {
        return plainToClass(this.className, value, {excludeExtraneousValues:true}) as object as any;
    }
}

and you can apply this pipe running as a decorator on your controller:

@UsePipes(new SanitizePipe(CreateUserDTO))

Hope it helps.

user_35126940

You need to use class-sanitizer and apply sanitize(payload)

user_31516570
Related