Registry / security / restify-safe-json-formatter

restify-safe-json-formatter

library0.4.10jsnpmunverified

A restify formatter that unicode-escapes <, >, and & characters in JSON responses as \u003c, \u003e, and \u0026 respectively, preventing browsers from interpreting JSON as HTML. Version 0.4.10 is the latest release, last updated in 2018. It requires Node.js >=10 and npm >=6.4.1. This package is a lightweight alternative to manually escaping JSON for XSS prevention, specifically designed for Restify servers.

security

npm install restify-safe-json-formatter

github ↗package ↗homepage ↗

INSTALL

IMPORT

SIG · RESTIFY-SAFE-JSON-

restify-safe-json-formatter

securityjavascriptv0.4.10

harness data pending

Install & Compatibility

Where this runs

No compatibility data collected yet for this library.

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

default

✓ import safeJsonFormatter from 'restify-safe-json-formatter'

✗ const safeJsonFormatter = require('restify-safe-json-formatter')

ESM import is preferred, though CJS require works with older bundlers.

safeJsonFormatter

✓ const safeJsonFormatter = require('restify-safe-json-formatter')

✗ const { safeJsonFormatter } = require('restify-safe-json-formatter')

The module exports a single function as default, not a named export.

Formatter

✓ type Formatter = (req: Request, res: Response, body: any) => string

No TypeScript types ship with this package; define manually or use any.

Creates a Restify server using safeJsonFormatter to escape HTML-like characters in JSON responses.

import restify from 'restify'; import safeJsonFormatter from 'restify-safe-json-formatter'; const server = restify.createServer({ formatters: { 'application/json; q=0.9': safeJsonFormatter } }); server.get('/api/data', (req, res, next) => { res.json({ message: '<script>alert(1)</script>' }); next(); }); server.listen(8080, () => { console.log('Server listening on port 8080'); });

Debug

Known issues

gotchaThe formatter only escapes <, >, and & characters. Other characters like " (double quote) are not escaped.

fix

If full JSON escaping is needed, consider using a more comprehensive serializer.

affects: >=0.0.0

gotchaThe formatter is applied only to responses with the matching MIME type pattern 'application/json; q=0.9'. Ensure your response headers use this exact pattern.

fix

Use res.json() which sets Content-Type to application/json by default.

affects: >=0.0.0

deprecatedThe package has not been updated since 2018 and may not work with modern Restify versions (v10+).

fix

Check Restify v10+ compatibility; consider using restify's built-in formatter or a custom one.

affects: >=0.0.0

gotchaThe formatter returns a string, not a Buffer. Restify may expect a Buffer, possibly causing issues in older versions.

fix

In Restify <10, wrap the return value in Buffer.from() if needed.

affects: <0.0.0

Errors

Common errors & fixes

TypeError: safeJsonFormatter is not a function

Importing as named export instead of default.

fix

Use const safeJsonFormatter = require('restify-safe-json-formatter') or import safeJsonFormatter from 'restify-safe-json-formatter'.

Error: formatter 'application/json; q=0.9' not found

MIME type pattern mismatch; ensure the formatters key matches your response Content-Type.

fix

Set formatters key to 'application/json' or use res.json() which sets Content-Type automatically.

SyntaxError: Unexpected token < in JSON

The formatter escapes <, >, & but some clients expect raw JSON without escaping.

fix

Do not use safeJsonFormatter if clients need raw JSON; use restify's default JSON formatter.

Upgrade

Version history

0.4.10latest on npm

Audit

Dependencies

restifyrequiredPeer dependency; the formatter is used as a Restify formatter plugin.

Agent activity

20 hits · last 30 days

node

OpenAI (training)

Resources

githubhttps://github.com/g-k/restify-safe-json-formatter ↗

packagerestify-safe-json-formatter ↗

homepagehttps://github.com/g-k/restify-safe-json-formatter#readme ↗