Sanitizing form data

It isn’t just files that you should be cautious about receiving from users: any data has the potential to cause problems. The most common problem is a cross-site scripting (XSS) attack where a data value is crafted so that it is interpreted by the browser as HTML elements or JavaScript code. In Chapter 7, I demonstrated how a content security policy can be used to help prevent XSS by telling the browser how the application is expected to behave, but another good measure is to sanitize data that is received from one user so that it doesn’t contain characters that browsers will interpret unexpectedly when it is displayed to another user. To prepare, Listing 11.17 changes the form handler so it returns an HTML response.

Listing 11.17: Returning an HTML response in the forms.ts file in the src/server folder

import express, { Express } from "express";
import multer from "multer";
const fileMiddleware = multer({storage: multer...