express-html-sanitizer is an Express JS middleware designed to clean up and sanitize JSON request bodies by recursively removing unwanted HTML tags. It leverages the `sanitize-html` module for its core sanitization logic. The package is currently at version 1.0.1 and appears to be in an abandoned state, with no updates or commits in several years, meaning it lacks a defined release cadence and may not be actively maintained for security or feature updates. Its primary differentiator is its recursive application of HTML sanitization directly within the Express middleware chain, making it suitable for RESTful services that process JSON inputs potentially containing user-generated HTML.
npm install express-html-sanitizerVerified import paths — ran on the pinned version, not inferred.
Demonstrates setting up an Express application with `body-parser` and `express-html-sanitizer` middleware to sanitize POST request bodies using a custom configuration before handling the request.
Evaluate actively maintained HTML sanitization libraries for Express, or fork and maintain the package yourself.
Ensure `app.use(bodyParser.json());` (or `express.json()`) is called before `app.use(sanitizeReqBody);`.
Use `const sanitizer = require('express-html-sanitizer');` for all imports.Always explicitly define a `config` object with `allowedTags`, `allowedAttributes`, and other options tailored to your security requirements when initializing the middleware (e.g., `sanitizer(customConfig)`).
Add `app.use(express.json());` or `app.use(require('body-parser').json());` before `app.use(sanitizeReqBody);` in your Express application setup.Change your import statement to `const sanitizer = require('express-html-sanitizer');` or ensure your environment correctly handles CommonJS modules.Provide a strict `config` object to `sanitizer()` that explicitly defines only the `allowedTags` and `allowedAttributes` necessary for your application. For example: `sanitizer({ allowedTags: [], allowedAttributes: {} })` to strip all HTML.