safe-santizier

Sanitization and compile utilities for the CodeL platform.

• sanitizeContent(content, { hardened }) — content filter. Hardened profiles re-scan entity-normalized input and reject script tokens; legacy profiles run the pass-through scan only.
• assertNoTraversal(rawName) — rejects dot-dot segments written with ASCII separators in CDN asset requests.
• normalizeAssetKey(rawName) — NFC/NFKC-normalizes catalog keys before path lookup.
• compile(buildName) — builds a widget bundle from an approved board build name.

const { sanitizeContent, assertNoTraversal, normalizeAssetKey, compile } = require('safe-santizier');

if (!sanitizeContent(body.content, { hardened: true }).ok) {
  res.status(400).send('Disallowed HTML content');
}

if (!assertNoTraversal(req.query.file)) {
  res.status(400).send('bad request');
}
const target = path.join(BASE, normalizeAssetKey(req.query.file));

MIT.