`exisjs/sanitize`

The exisjs/sanitize module provides pure data sanitization functions for cleaning and normalizing input strings, numbers, dates, arrays, and complex objects before business logic execution. It includes security transforms for XSS escaping, HTML stripping, and basic SQL injection and path traversal probe detection.

Module Exports

import { sanitize } from 'exisjs/sanitize'

1. Security Sanitizers

The SQL and path traversal checks reject common probe strings; they complement, and never replace, parameterized queries and resolved-path checks. A sanitizer that throws inside .sanitize() becomes a 400 validation error for that field (code SANITIZATION_FAILED).

Function	Signature	Description
`sanitize.escapeHtml`	`(val: string) => string`	Escapes `&`, `<`, `>`, `"`, and `'` into HTML entities. Use it for text shown in HTML.
`sanitize.stripHtml`	`(val: string) => string`	Removes tags, comments, and `<script>` / `<style>` elements with their content. A `<` that does not start a tag (`a < b`) is kept.
`sanitize.stripControlChars`	`(val: string) => string`	Removes invisible control characters (keeps tab and line breaks) and the bidirectional overrides used to disguise text.
`sanitize.preventSql`	`(val: string) => string`	Throws on common SQL injection probes (`' or 1=1`, `union select`, ...).
`sanitize.preventTraversal`	`(val: string) => string`	Throws on a `..` path segment (also `\` separators and percent-encoded forms such as `%2e%2e%2f`) and on NUL bytes. `report..final.pdf` is allowed.
`sanitize.maskEmail`	`(val: string) => string`	Obfuscates email addresses (e.g., `al***@example.com`).
`sanitize.maskString`	`(val: string) => string`	Keeps the first and last two characters (`ab****yz`).

2. Text & String Sanitizers

Function	Signature	Description
`sanitize.trim`	`(val: string) => string`	Strips leading and trailing whitespace.
`sanitize.toLowerCase`	`(val: string) => string`	Converts all characters to lowercase.
`sanitize.toUpperCase`	`(val: string) => string`	Converts all characters to uppercase.
`sanitize.collapseWhitespace`	`(val: string) => string`	Collapses consecutive whitespace, tabs, and newlines into a single space.
`sanitize.normalizeUnicode`	`(val: string) => string`	Normalizes to Unicode NFC, so visually equal strings compare equal.
`sanitize.normalizeEmail`	`(val: string) => string`	Trims and lowercases an email address.
`sanitize.slugify`	`(val: string) => string`	URL-friendly slug; accented letters keep their base letter (`"Café Crème"` $ o$ `"cafe-creme"`).
`sanitize.truncate(length)`	`(length: number) => (val: string) => string`	Shortens to `length` characters without splitting an emoji in two.
`sanitize.removeNonAlphanumeric`	`(val: string) => string`	Strips all characters except ASCII letters and digits.
`sanitize.normalizeLineEndings`	`(val: string) => string`	Converts `

and lone to `. |

3. Numbers

Function	Signature	Description
`sanitize.round(decimals?)`	`(decimals = 0) => (val: number) => number`	Rounds to `decimals` places.
`sanitize.clamp(min, max)`	`(min: number, max: number) => (val: number) => number`	Constrains a number to `[min, max]`.

4. Arrays & Objects

Array Transforms

Function	Signature	Description
`sanitize.dedupe`	`<T>(val: T[]) => T[]`	Removes duplicate values preserving first-seen ordering.
`sanitize.compact`	`<T>(val: T[]) => T[]`	Removes `null`, `undefined`, and empty strings (`""`).
`sanitize.trimElements`	`(val: string[]) => string[]`	Trims every string item.
`sanitize.limitLength(n)`	`(length: number) => <T>(val: T[]) => T[]`	Keeps the first `length` items.

Object Transforms

Function	Signature	Description
`sanitize.pick(keys)`	`<T, K extends keyof T>(keys: K[]) => (val: T) => Pick<T, K>`	Keeps only the listed keys the object itself has (never inherited ones such as `constructor`).
`sanitize.omit(keys)`	`<T, K extends keyof T>(keys: K[]) => (val: T) => Omit<T, K>`	Removes the listed keys.
`sanitize.deepTrim`	`<T>(val: T) => T`	Trims every string in a nested object or array.

Every sanitizer passes values of another type through unchanged (a string sanitizer returns a number as is, an array sanitizer returns a non-array as is), so they are safe on optional and nullable fields.

5. Integration with TexEngine Validation

Sanitizers integrate with tex validator chains using the .sanitize() modifier. Sanitization occurs before rule validation checks:

src/http/articles/schema.ts

import { tex } from 'exisjs/validator'
import { sanitize } from 'exisjs/sanitize'

export const CreateArticleSchema = tex.object({
  title: tex
    .string({ min: 5, max: 120 })
    .sanitize(sanitize.trim, sanitize.collapseWhitespace),

  slug: tex
    .string()
    .sanitize(sanitize.slugify),

  content: tex
    .string()
    .sanitize(sanitize.stripHtml),

  tags: tex
    .array(tex.string())
    .sanitize(sanitize.dedupe, sanitize.compact),
})

6. Standalone Usage Example

src/services/import.service.ts

import { sanitize } from 'exisjs/sanitize'

export function processUserInput(rawContent: string): string {
  const step1 = sanitize.stripHtml(rawContent)
  const step2 = sanitize.collapseWhitespace(step1)
  const clean = sanitize.trim(step2)
  return clean
}

Continue to Swagger Reference Edit this page on GitHub