Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

How to sanitize Json with Oak? #152

Closed
ghost opened this issue Jun 6, 2020 · 3 comments
Closed

How to sanitize Json with Oak? #152

ghost opened this issue Jun 6, 2020 · 3 comments
Labels
question A general question versus an issue or defect

Comments

@ghost
Copy link

ghost commented Jun 6, 2020

is there something similar to ExpressJS app.use(express.json()) ?

@kitsonk kitsonk added the question A general question versus an issue or defect label Jun 6, 2020
@kitsonk
Copy link
Collaborator

kitsonk commented Jun 6, 2020

How does express.json() "sanaitize" JSON? The automatic body parsing of oak handles JSON bodies fine: https://github.com/oakserver/oak#request and an example: https://github.com/oakserver/oak/blob/master/examples/routingServer.ts#L55-L58.

Are there options of express.json() that you feel are missing in the automatic body parsing?

@ghost
Copy link
Author

ghost commented Jun 6, 2020

I'm just asking because I'm worried about injection etc

@kitsonk
Copy link
Collaborator

kitsonk commented Jun 7, 2020

What sort of injection? express.json() doesn't sanitise anything. If you are worried about __proto__ type of injections (which I don't believe express.json() accounts for) then Deno doesn't suffer from that at all (see: denoland/deno#4324).

oak doesn't currently support a "strict" mode or allows the passing of a custom reviver, like express.json() does, but those really don't have anything to do with "sanitising" JSON.

@kitsonk kitsonk closed this as completed Jun 11, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
question A general question versus an issue or defect
Projects
None yet
Development

No branches or pull requests

1 participant