feat(security): add global input sanitization for string fields

Add a SanitizationPipe registered after the global ValidationPipe so every
request value is first rejected when malformed, then recursively cleaned of
script-injection vectors (HTML/script tags, stray angle brackets and
non-printable control characters) before reaching route handlers. Sanitization
rules live in a shared sanitize util and apply to all string fields in bodies,
queries and route params. Closes #83.

Author: manoahLinks

src/common/pipes/sanitization.pipe.ts

@@ -0,0 +1,18 @@
+import { Injectable, PipeTransform } from '@nestjs/common';
+import { sanitizeDeep } from '../sanitization/sanitize.util';
+
+/**
+ * Issue #83 - global input sanitization pipe.
+ *
+ * Registered after the ValidationPipe so it operates on values that have
+ * already been validated and transformed into their DTO shape (malformed
+ * objects are therefore rejected before they ever reach this pipe). It then
+ * recursively strips dangerous characters from every string field, removing
+ * script-injection payloads before they reach route handlers or persistence.
+ */
+@Injectable()
+export class SanitizationPipe implements PipeTransform {
+  transform(value: unknown): unknown {
+    return sanitizeDeep(value);
+  }
+}

src/common/sanitization/sanitize.util.ts

@@ -0,0 +1,66 @@
+/**
+ * Issue #83 - shared text sanitization rules.
+ *
+ * These helpers neutralize the characters most commonly used in script
+ * injection / XSS payloads so that no user-supplied string reaches a route
+ * handler (or the database) with an embedded markup or control sequence.
+ */
+
+// Any `<...>` sequence - strips full HTML/script tags.
+const HTML_TAGS = /<[^>]*>/g;
+// Stray angle brackets left after tag removal.
+const ANGLE_BRACKETS = /[<>]/g;
+
+/**
+ * Drops non-printable control characters (code points 0x00-0x1F and 0x7F)
+ * while preserving tab (0x09), newline (0x0A) and carriage return (0x0D),
+ * which are legitimate text content.
+ */
+function stripControlChars(value: string): string {
+  let out = '';
+  for (const ch of value) {
+    const code = ch.codePointAt(0) ?? 0;
+    const isControl =
+      (code <= 0x1f && code !== 0x09 && code !== 0x0a && code !== 0x0d) ||
+      code === 0x7f;
+    if (!isControl) {
+      out += ch;
+    }
+  }
+  return out;
+}
+
+/** Removes dangerous characters from a single string value. */
+export function sanitizeString(value: string): string {
+  return stripControlChars(value)
+    .replace(HTML_TAGS, '')
+    .replace(ANGLE_BRACKETS, '');
+}
+
+/**
+ * Recursively sanitizes every string contained in a value, mutating objects
+ * and arrays in place so DTO class instances keep their type while their
+ * string fields are cleaned. Non-string primitives are returned untouched.
+ */
+export function sanitizeDeep<T>(value: T): T {
+  if (typeof value === 'string') {
+    return sanitizeString(value) as unknown as T;
+  }
+
+  if (Array.isArray(value)) {
+    for (let i = 0; i < value.length; i++) {
+      value[i] = sanitizeDeep(value[i]);
+    }
+    return value;
+  }
+
+  if (value !== null && typeof value === 'object') {
+    const record = value as Record<string, unknown>;
+    for (const key of Object.keys(record)) {
+      record[key] = sanitizeDeep(record[key]);
+    }
+    return value;
+  }
+
+  return value;
+}

src/main.ts

@@ -5,6 +5,7 @@ import compression from 'compression';
 import { AppModule } from './app.module';
 import { ConfigService } from './config/config.service';
 import { JsonLoggerService } from './common/logger/json-logger.service';
+import { SanitizationPipe } from './common/pipes/sanitization.pipe';
 
 async function bootstrap() {
   // Bootstrap with a temporary console logger so early errors are visible,
@@ -65,14 +66,17 @@ async function bootstrap() {
   // (1 KB) avoids the overhead for tiny payloads that wouldn't benefit.
   app.use(compression({ threshold: 1024 }));
 
-  // ── Validation pipe ────────────────────────────────────────────────────────
+  // ── Validation + sanitization pipes (issue #83) ───────────────────────────
+  // ValidationPipe rejects malformed objects before they reach handlers, then
+  // SanitizationPipe strips dangerous characters from every string field.
   app.useGlobalPipes(
     new ValidationPipe({
       whitelist: true,
       transform: true,
       forbidNonWhitelisted: true,
       transformOptions: { enableImplicitConversion: true },
     }),
+    new SanitizationPipe(),
   );
 
   // ── Graceful shutdown ──────────────────────────────────────────────────────