Feature request: remove unknown fields

Until now, you have allowUnknown*, which make sure that keys not intended in the data are passed through or not.

This is a feature request:

Modify the options, such that keys not intended to be in the data are dropped. The idea comed from Paperwork:

Paperwork now silently removes unknown fields from the validated blob. This is done so you never pass unvalidated data to your code. For instance, if an attacker was to pass an extra id, you might end up using it to update the wrong object in your database.

I also pushed this idea for isvalid. There we use the following schema:

• unknownBody with the possible values of ‘allow’, ‘deny’, ‘remove’

Instad of allowUnknown*: false and allowUnknown*: true

The reason is the following: middleware frameworks such as Angular are sending a lot more framework specific data within the JSON, which I want to be removed.

[francescovigolungo]

I found a workaround, with customSanitizer

sanitize('*').customSanitizer((value, { req, location, path }) => {
       if(path === 'field_to_delete'){
             delete req.body[path];
             return;
       }
       return value;
 })

[dubiousandrew]

Going off the previous post, you can create your own reusable function like this:

export const removeFieldsSanitizer = (remove: Array<string>) =>
  sanitize("*").customSanitizer((value, { req, location, path }) => {
    if (remove.find((v) => v === path)) {
      delete req.body[path];
      return;
    }
    return value;
  });

and use it like this:

router.post('/edit-user', 
[removeFieldsSanitizer(['password', 'username'])], (req, res)=>{...});