is there way to sanitize schema field like middleware?

[luasenvy]

hi, I'm looking for a way to handle xss.
can i sanitize schema field data In one place like middleware?

like this:

const sanitize = require('sanitize-html')
MIDDLEWARE('sanitize', async function($){
  // but not initialize yet model and body field.
  $.body.content = sanitize($.body.content)
  $.next()
})

[petersirka]

This is not good idea because I recommend to sanitize rendering only. This may work in latest version of Total.js framework:

NEWSCHEMA('YourSchemaName', function(schema) {

    schema.middleware(function($, next) {

        // $.name === name of executed operation
        switch ($.name) {
            case 'save':
            case 'insert':
            case 'update':

                for (var i = 0; i < schema.fields.length; i++) {
                    var field = schema.fields[i];
                    if (typeof($.model[field]) === 'string')
                        $.model[field] = sanitize($.model[field]);
                }

                break;
        }

        next();
    });

});

or via middleware like your:

MIDDLEWARE('sanitize', function($){
    var keys = Object.keys($.body);
    for (var i = 0; i < keys.length; i++) {
        var key = keys[i];
        if (typeof($.body[key]) === 'string')
            $.body[key] = sanitize($.body[key]);
    }
    $.next();
});

[luasenvy]

thank you for reply.

I will use it as your recommendation. 👍