René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"Sanitize model strings","articleBody":"I've been looking into preforming string sanitization on user input for both the `User` and `Thing` models. My goal is to reduce native vulnerabilities to XSS by removing/escaping HTML entities. Besides it being just a good idea in general, I'd like to secure the stack against this further, to better allow for the use of other technologies such as Local Storage; which is completely vulnerable to XSS.\n\nI'm wondering if defining a schema plugin to sanitize string type values would be wise? Or should they be handled on a per key basis. The plugin solution would be easy to use since you could add it to an entire schema. However the second option of defining a pre-save hook to sanitize specific keys could prove to be more performant. Since it would not need to loop (recursively) to find the string values. The plugin option could be useful for maintaining consistency in a project, especially when there are multiple developers. Again however, the pre-save hook could provide more individual control, allowing for more use cases.\n\nIf anyone here has any experience with mongoose and model sanitization, or just has an idea related to the subject, I'd love to hear it. \n","author":{"url":"https://github.com/kingcody","@type":"Person","name":"kingcody"},"datePublished":"2014-08-21T12:01:58.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":13},"url":"https://github.com/470/generator-angular-fullstack/issues/470"}