Feature/add express validator

controllers/portfolios.js

@@ -5,6 +5,7 @@
 const router      = require('express').Router();
 const verifyJWT   = require('../middleware/verifyJWT');
 const Portfolios  = require('../models/portfolios');
+const sanitizeInput = require('../middleware/sanitizeUserInput')
 
 const isOid       = require('../utils/validateObjectIds');
 const isTicker    = require('../utils/validateTickers');
@@ -35,7 +36,6 @@ router.get('/portfolios', (req, res, next) => {
 
 });
 
-
 /**
  * Get a specific portfolio belonging to a user
  * Example: GET >> /api/portfolios/65a4sd654asd645asd
@@ -66,7 +66,7 @@ router.get('/portfolios/:id', (req, res, next) => {
  *    2) portfolio name from req body
  * Returns: JSON portfolio object
 */
-router.post('/portfolios', (req, res, next) => {
+router.post('/portfolios', sanitizeInput(['name', 'notes']), (req, res, next) => {
 
   if (!req.body.name) {
     return res.status(400).json({ message: 'Portfolio "name" is required.' });
@@ -97,7 +97,7 @@ router.post('/portfolios', (req, res, next) => {
  *    3) updates from req body
  * Returns: JSON portfolio object
 */
-router.put('/portfolios/:id', (req, res, next) => {
+router.put('/portfolios/:id', sanitizeInput(['name', 'notes']), (req, res, next) => {
 
   if (!isOid(req.params.id)) {
     return res.status(400).json({ message: badParamMsg });
@@ -129,7 +129,7 @@ router.put('/portfolios/:id', (req, res, next) => {
  *    2) portfolio _id from req params
  * Returns: JSON success message
 */
-router.delete('/portfolios/:id', (req, res, next) => {
+router.delete('/portfolios/:id', sanitizeInput(['id']), (req, res, next) => {
 
   if (!isOid(req.params.id)) {
     return res.status(400).json({ message: badParamMsg });
@@ -152,7 +152,7 @@ router.delete('/portfolios/:id', (req, res, next) => {
  *    3) ticker and qty from req body
  * Returns: JSON portfolio object
 */
-router.post('/portfolios/:id/holdings', async (req, res, next) => {
+router.post('/portfolios/:id/holdings', sanitizeInput(['id', 'ticker', 'qty']), async (req, res, next) => {
 
   if (!req.body.ticker || !req.body.qty) {
     return res.status(400)
@@ -204,7 +204,7 @@ router.post('/portfolios/:id/holdings', async (req, res, next) => {
  *    4) qty from req body
  * Returns: JSON portfolio object
 */
-router.put('/portfolios/:pfloId/holdings/:hldgId', (req, res, next) => {
+router.put('/portfolios/:pfloId/holdings/:hldgId', sanitizeInput(['qty']), (req, res, next) => {
 
   if (!isOid(req.params.pfloId || !isOid(req.params.hldgId))) {
     return res.status(400).json({ message: badParamMsg });

middleware/sanitizeUserInput.js

@@ -0,0 +1,13 @@
+const { sanitizeBody, sanitize } = require('express-validator/filter');
+
+const { buildSanitizeFunction } = require('express-validator/filter');
+const sanitizeUserInputs = buildSanitizeFunction(['body', 'query', 'params']);
+
+
+module.exports = ( valuesArray ) => {
+    return valuesArray.map( val => {
+        return sanitizeUserInputs(val)
+                    .blacklist( '{}' )   //escapes any chars passed into it
+                    .escape()            //escapes HTML chars
+    } )
+}

package.json

@@ -32,6 +32,7 @@
     "body-parser": "^1.18.2",
     "dotenv": "^5.0.0",
     "express": "^4.16.2",
+    "express-validator": "^5.0.1",
     "jsonwebtoken": "^8.1.1",
     "mongodb": "^3.0.2",
     "morgan": "^1.9.0"