ajv-sanitizer

library1.2.1jsnpmunverified

Adds string sanitization keyword to Ajv JSON Schema validation. Current stable version 1.2.1 (2020). Low release cadence. Integrates validator.js sanitizers into Ajv schemas via a custom 'sanitize' keyword. Differs from alternatives like fast-json-stringify or json-schema-faker by mutating data in-place during validation. Peer dependency on Ajv 8.x. Supports ESM and CommonJS. Allows custom sanitizer functions per schema or globally.

storage security

npm install ajv-sanitizer

github ↗package ↗homepage ↗

INSTALL

IMPORT

SIG · AJV-SANITIZER

ajv-sanitizer

storagejavascriptv1.2.1

harness data pending

Install & Compatibility

Where this runs

No compatibility data collected yet for this library.

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

ajvSanitizer

✓ import ajvSanitizer from 'ajv-sanitizer'

✗ const ajvSanitizer = require('ajv-sanitizer');

Default export: a function that adds sanitize keyword to an Ajv instance. Works with both CJS require and ESM import.

ajvSanitizer

✓ const ajvSanitizer = require('ajv-sanitizer');

CommonJS require works. Use default import in TypeScript or ESM.

sanitize

✓ schema.properties.field.sanitize = 'trim'

✗ schema.properties.field.sanitize = 'trim' in a non-string type

The 'sanitize' keyword is added to the Ajv instance and only applies to string type properties in schemas.

Shows how to import ajv-sanitizer, create Ajv instance, define schema with sanitize keyword, and mutate data via validate().

import Ajv from 'ajv'; import ajvSanitizer from 'ajv-sanitizer'; const ajv = new Ajv(); ajvSanitizer(ajv); const schema = { type: 'object', properties: { value: { type: 'string', sanitize: 'text', // escape then trim }, }, }; const data = { value: ' trim & escape string ', }; ajv.validate(schema, data); console.log(data.value); // "trim & escape string"

Debug

Known issues

breakingajv-sanitizer mutates the data object in-place during validation. Always validate after sanitizing; the data is transformed.

fix

Clone data before validate if original needed: const dataClone = JSON.parse(JSON.stringify(data));

affects: >=1.0.0

breakingsanitize keyword only works with string type properties. Using it on non-string types silently does nothing or errors.

fix

Ensure schema property type is 'string' when using sanitize.

affects: >=1.0.0

gotchaCustom sanitizer functions must return a string. Returning non-string causes runtime error.

fix

Always return a string from your custom sanitizer function.

affects: >=1.0.0

deprecatedThe 'boolean', 'date', 'float', 'int', 'number' sanitizers use validator.js methods that may be deprecated. Check validator.js docs for replacements.

fix

Use more specific sanitizers (e.g., 'trim', 'escape') or implement custom functions.

affects: >=1.0.0

Errors

Common errors & fixes

TypeError: ajvSanitizer is not a function

Using wrong import style (e.g., named import instead of default).

fix

Use default import: import ajvSanitizer from 'ajv-sanitizer';

Uncaught TypeError: Cannot read properties of undefined (reading 'validate')

Forgot to call ajvSanitizer(ajv) before using validate with sanitize keyword.

fix

Ensure you call ajvSanitizer(ajv) right after creating the Ajv instance.

data.value is not trimmed / not escaped

sanitize keyword may not be applied if schema validation fails (Ajv stops on first error). Use { allErrors: true } or validate after fixing errors.

fix

Set Ajv option allErrors: true or re-validate after correcting data.

Upgrade

Version history

1.2.1latest on npm

Audit

Dependencies

ajvrequiredpeer dependency required to extend Ajv instance

Agent activity

45 hits · last 30 days

node

Resources

githubhttps://github.com/53js/ajv-sanitizer ↗

packageajv-sanitizer ↗

homepagehttps://github.com/53js/ajv-sanitizer ↗