provejs-express

v1.0.1

Published

3 years ago

Form validation and data filtering for Express

Downloads

0High
0Medium
0Low

dhollenbeck

form validator validation express

provejs-express

Provides data sanitizing and validation as express middleware.

Install

npm install provejs-express --save

Usage

var express = require('provejs-express');
var bodyParser = require('body-parser');
var form = require('express-form');
var field = form.field;

var app = express();
app.use(bodyParser());

var validation = form(
    field('username').toTrim().isRequired().is(/^[a-z]+$/),
    field('password').toTrim().isRequired().is(/^[0-9]+$/),
    field('email').toTrim().isEmail()
);

var controller = function(req, res){

    // Use req.form as this contains your validated and sanitized data.
    // Don't use req.body because that is unsanitized and unvalidated data.
    var isValid = req.form.isValid;
    var errors = req.form.getErrors();
    var username = req.form.username;
    var password = req.form.password;
    var email = req.form.email;

    if (!isValid) {
        console.log(req.form.errors);
    } else {
        console.log('Username:', username);
        console.log('Password:', password);
        console.log('Email:', email);

        // errors are automatically saved in res.locals
        console.log('res.locals.errors', res.locals.errors);
    }
};

app.post('/user', validation, controller);
app.listen(3000);

Features

Automatically save errors to res.locals.errors.
Supports all validators from https://github.com/chriso/validator.js/
Supports all sanitizers from https://github.com/chriso/validator.js/
Supports additional validators and sanitizers.

Module

provejs-express returns an express Route Middleware function. You specify sanitizing and validation by passing sanitizers and validators as arguments to the main module function. For example:

var form = require('provejs-express');
var available = function(value, data, locals, next) {
    // check username available
    // next(new Error('That %s is already taken'));
    next();
};
var validator = form(form.field('username').toTrim().isMinLength(6).custom(avaliable));
var controller = function(req, res) {};
app.post('/user', validator, controller);

Fields

The field property of the module creates a saniter/validator object tied to a specific field. All sanitizers method names begin with to and all validator method names with is.

field(fieldname[, label]);

You can access nested properties with either dot or square-bracket notation.

field('post.content').isMinLength(50),
field('post[user][id]').isInt(),
field('post.super.nested.property').isRequired()

Simply specifying a property like this, makes sure it exists. So, even if req.body.post was undefined, req.form.post.content would be defined. This helps avoid any unwanted errors in your code.

The API is chainable, so you can keep calling sanitizer/validator methods one after the other:

field('username')
  .isRequired()
  .toTrim()
  .toLower()
  .toTruncate(5)
  .isAlphanumeric()

Sanitize API:

The sanitize methods are used to:

coerce inputs into a specific data type,
perform string transformations,
set a default data value.

All sanitizers methods begin with the to prefix in the method name.

toArray()

Converts the field input into an array.

By design if the input not intended to be an array (and you don't use toArray()), but the user submits an array value only the first value will be used. This means that you don't have to worry about unexpected post data that might break your code. Eg/ when you call an array method on what is actually a string.

Example: we want 'project.users' to be an array.

field('project.users').toArray(),
// undefined => [], '' => [], 'q' => ['q'], ['a', 'b'] => ['a', 'b']

Example: we do not want 'project.block' to be an array.

field('project.block'),
// project.block: ['a', 'b'] => 'a'. No 'array()', so only first value used.

In addition, any other methods called with the array method, are applied to every value within the array.

field('post.users').toArray().toUpper()
// post.users: ['one', 'two', 'three'] => ['ONE', 'TWO', 'THREE']

toBlacklist(blacklist)

Remove characters that appear in the blacklist.

blacklist (String): String of characters to remove. The characters are used in a RegExp and so you will need to escape some chars.

var middleware = form(field('foobar').toBlackList('\\[\\]'));
var controller = function(req, res) {};
router.post('/colors', middleware, controller);

Published

Vulnerabilities

Links

Maintainers

Keywords

Readme

provejs-express

Install

Usage

Features

Module

Fields

Sanitize API:

toArray()

toBlacklist(blacklist)

toBoolean()

toBooleanStrict()

toDate()

toDefault(any)

toCss(options)

toEmail(options)

toEscape()

toFloat()

toHtml(options)

toInt(radix)

toLower()

toMoment([timezoneFrom[, timezoneTo]])

toStripLow([keep_new_lines])

toTrim([chars])

toTrimLeft([chars])

toTrimRight([chars])

toTruncate(length)

toUnescape()

toUpper()

toWhitelist(whitelist)

toSplit([delim])

custom(func)

Validator API:

is(pattern[, modifiers[, message]])

isAfter([str[,message]])

isAlpha([locale [,message]])

isAlphanumeric([locale [,message]])

isArrayLength(min, max [,message])

isAscii([message])

isBase64([message])

isBefore([date [,message]])

isBoolean([message])

isByteLength([options [,message]])

isContains(value [,message])

isCreditCard([message])

isCurrency([options[, message]])

isDataURI([message])

isDate([message])

isDateRange([message])

isDecimal([options[, message]])

isDivisibleBy([number[, message]])

isEmail([options[, message]])

isEmpty([message])

isEquals(value [,message])

isFQDN([options[, message]])

isFinite([message])

isFloat([options[, message]])

isFullWidth([message])

isHalfWidth([message])

isHash([message])

isHexColor([message])

isHexadecimal([message])

isIP([message])

isISBN([message])

isISIN([message])

isISO31661Alpha2([message])

isISO8601([message])

isISRC([message])

isISSN([message])

isIn([message])

isInt([message])

isJSON([message])

isLatLong([message])

isLength([message])

isLowercase([message])