I'm trying to use sanitize-html and Joi for XSS data validation in a form. I made an extended class from Error named ExpressError, which has been working perfectly fine on every validation of my other requests.
This is my ExpressError.js file
class ExpressError extends Error {
constructor(message, statusCode) {
super();
this.message = message;
this.statusCode = statusCode;
}
}
module.exports = ExpressError
And here my Joi and sanitize Html file named schemas.js
const BaseJoi = require('joi');
const sanitizeHtml = require('sanitize-html');
const extension = (joi) => ({
type: 'string',
base: joi.string(),
messages: {
'string.escapeHTML': '{{#label}} must not include HTML!'
},
rules: {
escapeHTML: {
validate(value, helpers) {
const clean = sanitizeHtml(value, {
allowedTags: [],
allowedAttributes: {},
});
if (clean !== value) return helpers.error('string.escapeHTML', { value })
return clean;
}
}
}
});
const Joi = BaseJoi.extend(extension)
module.exports.campgroundSchema = Joi.object({
campground: Joi.object({
title: Joi.string().required().escapeHTML(),
price: Joi.number().required().min(0),
location: Joi.string().required().escapeHTML(),
description: Joi.string().required().escapeHTML()
}).required(),
deleteImages: Joi.array()
});
module.exports.reviewSchema = Joi.object({
review: Joi.object({
rating: Joi.number().required().min(1).max(5),
body: Joi.string().required().escapeHTML()
}).required()
})