"use strict";
Object.defineProperty(exports, "__esModule", { value: true });
exports.xssSanitizer = void 0;
const sanitizeValue = (val) => {
    if (typeof val === 'string') {
        // Strip dangerous HTML tags and script injections
        return val
            .replace(/<script\b[^<]*(?:(?!<\/script>)<[^<]*)*<\/script>/gi, '')
            .replace(/javascript:/gi, '')
            .replace(/onload=/gi, '')
            .replace(/onerror=/gi, '');
    }
    if (typeof val === 'object' && val !== null) {
        for (const key in val) {
            val[key] = sanitizeValue(val[key]);
        }
    }
    return val;
};
const xssSanitizer = (req, res, next) => {
    if (req.body)
        req.body = sanitizeValue(req.body);
    if (req.query)
        req.query = sanitizeValue(req.query);
    if (req.params)
        req.params = sanitizeValue(req.params);
    next();
};
exports.xssSanitizer = xssSanitizer;
//# sourceMappingURL=xss.middleware.js.map