Input validation and sanitization in Node.js - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

What is the main purpose of input sanitization in Node.js applications?

Choose the best explanation for why input sanitization is important in Node.js apps.

A To remove or escape harmful characters from user input to prevent security issues like injection attacks.

B To speed up the processing of user input by compressing data before use.

C To convert all user input into uppercase letters for consistency.

D To store user input directly into the database without any changes.

💡 Hint

Think about how attackers might try to harm your app through user input.

Input sanitization cleans user data to prevent harmful code or commands from running, protecting the app from attacks like SQL injection or cross-site scripting.

❓ state_output

intermediate

What will be the output of this Node.js code snippet using the 'validator' library?

Consider the following code that validates and sanitizes an email input.

Node.js

import validator from 'validator';

const input = '  [e-mail]  ';
const isValid = validator.isEmail(input);
const sanitized = validator.normalizeEmail(input);

console.log(isValid, sanitized);

A true [e-mail]

B false [e-mail]

C true undefined

D false undefined

💡 Hint

Check how 'validator.isEmail' and 'validator.normalizeEmail' handle spaces.

'validator.isEmail' returns false because it does not ignore surrounding spaces, treating them as invalid. 'validator.normalizeEmail' trims and normalizes the email, returning '[e-mail]'.

🔧 Debug

advanced

Why does this input validation code fail to reject invalid usernames?

Review the code below that tries to validate usernames to be alphanumeric and 3-10 characters long.

Node.js

function validateUsername(name) {
  const regex = /^[a-zA-Z0-9]{3,10}$/;
  return regex.test(name.trim());
}

console.log(validateUsername(' user1 '));
console.log(validateUsername('user_2'));

A It fails because 'trim()' removes spaces inside the string, causing wrong validation.

B It fails because the regex allows underscores, so 'user_2' passes validation incorrectly.

C It fails because 'user_2' contains an underscore which is not allowed by the regex, so it returns false correctly.

D It fails because the regex does not check for length, so all inputs pass.

💡 Hint

Look carefully at the regex pattern and the test inputs.

The regex only allows letters and numbers, no underscores. 'user_2' contains an underscore, so it correctly fails validation. The function works as intended.

📝 Syntax

advanced

Which option correctly sanitizes user input to prevent cross-site scripting (XSS) in a Node.js Express app?

Choose the code snippet that safely sanitizes a string input to prevent XSS attacks.

Node.js

const express = require('express');
const app = express();

app.use(express.json());

app.post('/submit', (req, res) => {
  const userInput = req.body.comment;
  // Sanitize userInput here
  res.send(`Received: ${sanitizedInput}`);
});

A const sanitizedInput = userInput.replace(/<script.*?>.*?<\/script>/gi, '');

B const sanitizedInput = userInput.trim();

C const sanitizedInput = userInput.toUpperCase();

D const sanitizedInput = userInput.replace(/</g, '&lt;').replace(/>/g, '&gt;');

💡 Hint

Think about how to neutralize HTML tags to stop scripts from running.

Replacing '<' and '>' with their HTML entities prevents browsers from interpreting tags, stopping XSS. Removing only script tags (option D) can miss other harmful tags.

❓ component_behavior

expert

What will be the behavior of this Express middleware for input validation?

Analyze the middleware that validates a JSON body field 'age' to be a positive integer.

Node.js

function validateAge(req, res, next) {
  const age = req.body.age;
  if (!Number.isInteger(age) || age <= 0) {
    return res.status(400).json({ error: 'Age must be a positive integer' });
  }
  next();
}

// Usage in Express app
// app.use(express.json());
// app.post('/user', validateAge, (req, res) => res.send('User created'));

A Requests with age as 25 will pass and respond with 'User created'.

B Requests with age as '25' (string) will pass validation and respond with 'User created'.

C Requests with age as 0 will pass validation and respond with 'User created'.

D Requests missing the age field will pass validation and respond with 'User created'.

💡 Hint

Consider how Number.isInteger treats strings and missing values.

Number.isInteger returns false for strings and undefined. Age must be a positive integer number. Only numeric 25 passes; string '25', zero, or missing age fail.