Registry / web-framework / express-sanitizer

express-sanitizer

library1.0.6jsnpmunverified

Express middleware for sanitizing user input using the Caja-HTML-Sanitizer (Google Caja sanitizer) to mitigate persistent XSS risks. Version 1.0.6 is available on npm. The package has been in maintenance mode since 2021; its core dependency (sanitizer) has not been updated in years. It adds a `req.sanitize()` method to Express request objects. Compared to alternatives like express-validator, this library is minimal but unmaintained and should be avoided in new projects.

web-framework http-networking auth-security

npm install express-sanitizer

github ↗package ↗

INSTALL

IMPORT

SIG · EXPRESS-SANITIZER

express-sanitizer

web-frameworkjavascriptv1.0.6

Install

—

Import

—

Disk

—

Pass rate

0/ 6

Env Coverage0 / 6

glibc

18–22

musl

18–22

Install & Compatibility

Where this runs

tested against v? · npm install

Install × environment matrix

Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux

musl

node 18–226 runs

build_error

glibc

node 18–226 runs

build_error

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

expressSanitizer

✓ const expressSanitizer = require('express-sanitizer');

✗ import expressSanitizer from 'express-sanitizer';

This package does not ship ESM. Use CommonJS require to avoid errors.

req.sanitize

✓ app.use(expressSanitizer()); … req.sanitize(input)

✗ app.use(expressSanitizer); (missing invocation)

The middleware must be called as a function (expressSanitizer()) to attach the sanitize method.

sanitizer

✓ const sanitizer = require('sanitizer');

You can use the underlying sanitizer package directly, but it has the same maintenance issues.

Demonstrates setting up Express with express-sanitizer middleware and sanitizing a POST body property.

const express = require('express'); const expressSanitizer = require('express-sanitizer'); const app = express(); app.use(express.json()); app.use(expressSanitizer()); app.post('/sanitize', (req, res) => { const sanitized = req.sanitize(req.body.input); res.json({ sanitized }); }); app.listen(3000);

Debug

Known issues

deprecatedThe core dependency (sanitizer) has not been updated in 5 years and is considered abandonware.

fix

Migrate to a maintained alternative like express-validator or DOMPurify for server-side sanitization.

affects: >=1.0.0

gotchaThe expressSanitizer middleware must be invoked as a function (expressSanitizer()). If you pass the function reference without calling it, req.sanitize will not exist.

fix

Ensure you call it: app.use(expressSanitizer());

affects: >=0.1.0

gotchaThis package only provides basic string sanitization via req.sanitize(). It does not validate input types or provide rich validation like express-validator.

fix

Combine with express-validator or another validation library for comprehensive input handling.

affects: >=0.1.0

Errors

Common errors & fixes

TypeError: expressSanitizer is not a function

The import statement uses ES module syntax (import) with a CommonJS-only package.

fix

Use require('express-sanitizer') instead of import.

TypeError: req.sanitize is not a function

The middleware was either not used, or it was used incorrectly (e.g., app.use(expressSanitizer) instead of app.use(expressSanitizer())).

fix

Call the module as a function: app.use(expressSanitizer());

Cannot find module 'sanitizer'

The dependency 'sanitizer' is missing or not installed. This can happen if express-sanitizer is installed without its dependencies (e.g., using --no-optional or in a lockfile mismatch).

fix

Run npm install or explicitly add 'sanitizer' to your package.json.

Upgrade

Version history

1.0.6latest on npm

Audit

Dependencies

sanitizerrequiredProvides the HTML sanitization logic; wraps Google Caja sanitizer

Agent activity

15 hits · last 30 days

node

OpenAI (training)

Resources

githubhttps://github.com/markau/express-sanitizer ↗

packagehttps://www.npmjs.com/package/express-sanitizer ↗