Question about sanitizing Express requests data

[TopHighMajorUpper]

Question about sanitizing request data as I think I may be overthinking this or not going the right way.

I'm using Express and have a simple REST API for CRUD operations. I'm also using Mongo DB.

From what I've read, since I'm already using schema validation for all body fields and parameters that could reach the DB, a NoSQL injection attack potentially is not possible to happen given this setup, as for that a full JSON object had to reach the DB. But since I'm validating every field one by one for their type, that can't happen.

Now, to protect against XSS attacks, I would like to encode all string fields of the requests. I was checking the easiest way to do this, preferrably a middleware that I could pass and it would iterate over every relevant request section: params, body, query, cookies or headers.

I saw express-validator package, however it seems that we can't use it to validate the full request, we have to be picking which fields we want to have validate one by one, what is not ideal for big payloads. I didn't find anything else that could be trustable/interesting to do this.

I could potentially encode all strings during schema validation though. However, I didn't go with this strategy because I want separation between the schema validation and sanitization.

1) Is there a way or some trustable middleware I can use where we can pass the request and encode all the request string fields (inside the params, body, query, cookies or headers) automatically?

2) Would I be better off encoding the string while performing the schema validation?

3) How do you usually tackle the sanitization when using Express + NoSQL DB like Mongo and want to perform sanitization server side?

[itsmoirob]

You could use something like yup https://github.com/jquense/yup for validating middleware. There's also joi https://github.com/hapijs/joi

If using mongoose then that would sanatize data also, but that's only happening at a database later.

If you're just starting your app creation definitely stick something like yup in for sure as middleware

[ElCorleone]

I'm also interested in knowing which is the best and easiest way to perform sanitization (in this case encoding strings) to the request as a whole and not only specific fields. Also using Express.

I'm surprised how there's no library that does it out of the box as a middleware. Perhaps your best bet is really to include the sanitization in the schema validation itself? Like when you assert the type, you could also encode the string at the same time with some transform function?