query sanitation is not happening or not mutating req.query object

query sanitation is not happening or not mutating req.query object

var express = require('express')
var app = express()
const { query, validationResult } = require('express-validator')

const getUsersList = async (req, res, next) => {
    const validations = [
      query('saitizedParam').trim().escape(),
      query('testLenParam').isLength({ min: 5 }),
      query('textParam').not().isEmpty().trim().escape()
    ]

    await Promise.all(validations.map(validation => validation.run(req)))

    const errors = validationResult(req)
    if (errors.isEmpty()) {
      return next()
    }
    
    res.status(403).json({ error: errors.array() })
  }

app.get('/', getUsersList, function (req, res) {
  const {
    query
  } = req
console.log(query)  
res.status(200).json(query)
})

app.listen(3030)

try sending this: http://localhost:3030/?saitizedParam=%20%20%20Hello%20world%20:%3E)%20%20%20&testLenParam=qwerty&textParam=123test

console will output the same unsanitized value ie.e Hello world :>) with > and spaces kept

Validator.js version: 6.12.1 Express.js version: 5.0.0-alpha.8 Node.js version: v14.15.5 OS platform: windows

[mylawacad]

@fedeci yes, I tend to agree. Thank you for paying attention

[fedeci]

Y, that does not mutate the original req object and works👍