Elysia XSS

A plugin for Elysia.js that provides XSS (Cross-Site Scripting) protection by sanitizing request body data.

Features

• 🛡️ Automatic XSS protection for request body data
• 🔄 Recursive sanitization of nested objects and arrays
• 🎯 Configurable scope options
• ⚡ Zero Runtime Overhead (Instantiated once)
• 🪶 Lightweight with minimal dependencies
• 🚀 Built for Elysia.js and Bun

Installation

bun add elysia-xss

Usage

import { Elysia } from 'elysia'
import { elysiaXSS } from 'elysia-xss'

const app = new Elysia()
    .use(elysiaXSS()) // Use default XSS options
    .post("/comment", ({ body }) => body)
    .listen(3000)

Configuration

The plugin accepts standard xss configuration options. By default, it uses the standard whitelist provided by the xss library.

const app = new Elysia()
    .use(elysiaXSS({
        whiteList: { a: ['href', 'title', 'target'] }, // Custom whitelist
        stripIgnoreTag: true // Filter out all HTML not in the whitelist
    }))

How it Works

1. Auto-Sanitization: Automatically sanitizes all string values in the request body (including nested objects and arrays).
2. Secure by Design: Sanitization happens before validation. This prevents malicious payloads from bypassing validation rules (e.g., a huge payload that becomes small after stripping tags will still fail validation if checked against the original raw length, or vice versa).
   • Note: Validation logic will see the sanitized content.
3. Type Safety: Preserves input types and schema inference.

Dependencies

• Elysia - The web framework
• xss - XSS sanitizer

License

MIT

Contributing

Contributions are welcome! Please feel free to submit a Pull Request.