Business
Jobs
  • About Us
  • Solutions
    • Job Postings
      Post your job and receive qualified candidates in 48h.
    • Candidate Assessments
      500+ technical and psychological tests, plus anti-fraud.
    • Headhunting
      Tailor-made executive search from start to finish.
    • Payroll + EOR
      Payroll dispersal and EOR across 15+ LATAM countries.
  • Pricing
  • Jobs

0

251
Views
How to sanitize the readFileSync node js function input

I am trying to sanitize the input source JSON data in the below function. However, the Checkmarx tool still complains no matter where I add the sanitizeObject(). Appreciate any pointers

const fs = require('fs')
const config = require('config')
var _require = require('jsdom'),
    JSDOM = _require.JSDOM;

var window = new JSDOM('').window;
var DOMPurify = createDOMPurify(window);


function sanitizeValue(value){
      return DOMPurify.sanitize(value);

}

function sanitizeObject(obj) {
  var sanitizedObject = {};
  Object.keys(obj).forEach(function (key) {
    sanitizedObject[key] = sanitizeValue(obj[key]);
  });
  return sanitizedObject;
};

const getMyData = () => {

 let myData = JSON.parse(sanitizeObject(fs.readFileSync('./my/dist/path/mydata.json')))

return myData
}

Checkmarx error: Stored-CSS error as follows

complains at readFileSync

The application's = embeds untrusted data in the generated output with send, at Xx of module.js. This untrusted data is embedded straight into the output without proper sanitization or encoding, enabling an attacker to inject malicious code into the output.

The attacker would be able to alter the returned web page by saving malicious data in a data-store ahead of time. The attacker's modified data is then read from the database by the = method with readFileSync, at line 11 of module.js. This untrusted data then flows through the code straight to the output web page, without sanitization.

This can enable a Stored Cross-Site Scripting (XSS) attack

about 4 years ago · Juan Pablo Isaza
Answer question
Find remote jobs

Discover the new way to find a job!

Top jobs
Top job categories
Business
Post vacancy Pricing Sales
Legal
Terms and conditions Privacy policy
© 2026 PeakU Inc. All Rights Reserved.
Andres GPT
Show me some job opportunities
There's an error!