1. function sanitizeQueryString(queryString) {
  2. const params = {};
  4. if (!queryString) {
  5. return "Error: Query string is empty.";
  6. }
  8. const pairs = queryString.split('&');
  10. for (const pair of pairs) {
  11. const [key, value] = pair.split('=');
  13. if (!key) {
  14. return "Error: Invalid query parameter format.";
  15. }
  17. // Sanitize key - allow only alphanumeric characters and underscores
  18. const sanitizedKey = key.replace(/[^a-zA-Z0-9_]/g, '');
  20. if (!sanitizedKey) {
  21. return "Error: Invalid query parameter key.";
  22. }
  24. // Sanitize value - remove potentially harmful characters
  25. if (value) {
  26. const sanitizedValue = value.replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/&/g, "&amp;").replace(/"/g, "&quot;").replace(/'/g, "&#039;");
  27. params[sanitizedKey] = sanitizedValue;
  28. } else {
  29. params[sanitizedKey] = ""; //Handle empty values
  30. }
  31. }
  33. return params;
  34. }

Add your comment