Validation: Username and email lack input sanitization, vulnerable to injection and script attacks if stored in database #700

const newUser = new User({ username, email, password });

const sanitizeHtml = require('sanitize-html');
const mongoSanitize = require('express-mongo-sanitize');

// In app setup:
app.use(mongoSanitize());  // Prevents MongoDB injection

// In auth route:
router.post("/signup", validateRequest(signupSchema), async (req, res) => {
  const { username, email, password } = req.body;
  
  try {
    // Sanitize inputs
    const cleanUsername = sanitizeHtml(username.trim(), {
      allowedTags: [],
      allowedAttributes: {}
    });
    
    const cleanEmail = email.toLowerCase().trim();
    
    // Validate cleaned inputs
    if (cleanUsername !== username) {
      return res.status(400).json({
        message: 'Username contains invalid characters'
      });
    }
    
    const existingUser = await User.findOne({
      $or: [{ email: cleanEmail }, { username: cleanUsername }]
    });
    
    if (existingUser) {
      return res.status(400).json({
        message: 'Signup failed. Please try again.'
      });
    }
    
    // Store sanitized values
    const newUser = new User({
      username: cleanUsername,
      email: cleanEmail,
      password
    });
    
    await newUser.save();
    
    res.status(201).json({
      message: 'Account created successfully'
    });
  } catch (err) {
    res.status(400).json({
      message: 'Signup failed. Please try again.'
    });
  }
});