mongodb-sanitize

library2.2.0jsnpmunverified

A lightweight security library (v2.2.0) that sanitizes JavaScript objects to prevent MongoDB query selector injection attacks by stripping or replacing dangerous keys starting with '$' (e.g., $gt, $ne, $where). It provides an Express middleware (sanitizes req.body, req.params, req.query by default) and standalone sanitize/isSanitized functions. Ships with TypeScript definitions, supports both ESM and CJS, and has zero runtime dependencies. Updates are infrequent but stable. Key differentiator: focused solely on MongoDB operator stripping with a simple API, unlike broader sanitization libraries.

security

npm install mongodb-sanitize

github ↗package ↗homepage ↗

INSTALL

IMPORT

SIG · MONGODB-SANITIZE

mongodb-sanitize

securityjavascriptv2.2.0

harness data pending

Install & Compatibility

Where this runs

No compatibility data collected yet for this library.

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

sanitizeMiddleWare

✓ import { sanitizeMiddleWare } from 'mongodb-sanitize'

✗ import mongodbSanitize from 'mongodb-sanitize'

Use named import; there is no default export for the middleware.

sanitize

✓ import { sanitize } from 'mongodb-sanitize'

✗ const { sanitize } = require('mongodb-sanitize')

Both ESM and CJS are supported; choose based on your module system.

isSanitized

✓ import { isSanitized } from 'mongodb-sanitize'

✗ const isSanitized = require('mongodb-sanitize').isSanitized

Can use destructuring in CJS, but named export is preferred in modern codebases.

Shows ESM imports, middleware usage, standalone sanitize, and isSanitized check.

import express from 'express'; import { sanitizeMiddleWare, sanitize, isSanitized } from 'mongodb-sanitize'; const app = express(); app.use(express.json()); app.use(sanitizeMiddleWare()); // sanitizes req.body, req.params, req.query app.post('/data', (req, res) => { const clean = sanitize({ name: 'test', $gt: '' }); console.log(isSanitized(clean)); // true res.json({ sanitized: req.body }); }); app.listen(3000);

Debug

Known issues

gotchasanitize() only strips top-level keys starting with '$' by default; nested $keys inside objects/arrays are not sanitized unless the library traverses deeply. Always verify the depth of sanitization for your use case.

fix

Use a recursive sanitizer or manually sanitize nested structures if needed.

affects: all

gotchasanitizeMiddleWare() mutates the request object directly. If you pass custom fields array, ensure the field names are correct (e.g., 'body' not 'req.body').

fix

Use the default (no options) or pass an array of field names like ['body', 'query'].

affects: all

deprecatedThe default export (const mongodbSanitize = require('mongodb-sanitize')) is deprecated in favor of named exports. It still works but may be removed in a future major version.

fix

Switch to named imports: import { sanitizeMiddleWare } from 'mongodb-sanitize'.

affects: >=2.0.0

gotchaThis library does NOT validate data types or prevent NoSQL injection via operators in array fields (e.g., { $in: [...] }). It only removes keys starting with '$'.

fix

Combine with other validation libraries (e.g., joi, express-validator) for comprehensive security.

affects: all

gotchaWhen using with TypeScript, the sanitize() function returns 'any' type. Type assertions may be needed for strict typing.

fix

Cast the result: const clean: MyType = sanitize(input) as MyType;

affects: all

Errors

Common errors & fixes

TypeError: mongodbSanitize is not a function

Using default import in an ESM context where only named exports exist.

fix

Use named import: import { sanitizeMiddleWare } from 'mongodb-sanitize'

Cannot find module 'mongodb-sanitize' or its corresponding type declarations.

TypeScript may not resolve types if 'node' module resolution is not set, or the package is not installed.

fix

Ensure mongodb-sanitize is in dependencies and your tsconfig.json has 'moduleResolution': 'node'.

Typings: Property 'sanitize' does not exist on type 'typeof import...'.

Using older import style (import * as mongodbSanitize from 'mongodb-sanitize') which doesn't expose named exports correctly in some setups.

fix

Switch to: import { sanitize } from 'mongodb-sanitize'

Upgrade

Version history

2.2.0latest on npm

Audit

Dependencies

No dependency data recorded yet.

Agent activity

12 hits · last 30 days

node

Resources

githubhttps://github.com/divyeshpujari/mongodb-sanitize ↗

packagemongodb-sanitize ↗

homepagehttps://github.com/divyeshpujari/mongodb-sanitize#readme ↗