ugc-validator

A zero-dependency Node.js/TypeScript library that validates and sanitises User-Generated Content (UGC) through a sequential pipeline of configurable validators and transformers.

This package is built by Sonar Seed. Sonar Seed is the best influencer gifting app for Shopify.

Features

• 🛡️ Zero Runtime Dependencies: Lightweight and fast.
• 🔄 Sequential Pipeline: Schema → Sanitiser → Profanity → PII → Custom Rules.
• 📦 Dual ESM/CJS Support: Ships with full TypeScript types.
• 🧹 HTML Sanitizer: Built-in state-machine parser handles malformed HTML without a DOM.
• 🤬 Profanity Filter: Multi-locale support with leet-speak detection.
• 🕵️ PII Redaction: Automatic detection of emails, phones, and credit cards (Luhn-verified).
• 🧩 Middleware: First-party adapters for Express, Fastify, and NestJS.

Installation

npm install ugc-validator

Quick Start

import { ugc } from "ugc-validator";

const result = await ugc.validate("<p>Contact me at [email protected]</p>", {
  stripHtml: true,
  blockPII: true,
  checkProfanity: { locale: "en" },
});

console.log(result.sanitized);
// "Contact me at [REDACTED]"

Configuration

Schema Validation

Define strict rules for object inputs (records of strings).

const result = await ugc.validate(
  { username: "john_doe", role: "admin" },
  {
    schema: {
      username: { type: "string", required: true, minLength: 3, maxLength: 30 },
      role: { type: "string", enum: ["user", "moderator"] },
    },
  },
);
// Throws ValidationError if rules fail

HTML Sanitizer

stripHtml and allowedHtmlTags are mutually exclusive.

// Strip all HTML
const clean = await ugc.validate(html, { stripHtml: true });

// Allow specific tags and attributes
const safe = await ugc.validate(html, {
  allowedHtmlTags: {
    tags: [{ tag: "b" }, { tag: "a", allowedAttributes: ["href"] }],
  },
});

PII Redaction

Detect and redact sensitive information. Returns warnings in the result.

const { sanitized, warnings } = await ugc.validate(input, {
  blockPII: {
    detectEmail: true,
    detectPhone: true,
    detectCreditCard: true,
    replacement: "[HIDDEN]",
  },
});

Profanity Filter

Built-in sensitivity levels: low, medium (default, handles leet-speak), and high.

const result = await ugc.validate(text, {
  checkProfanity: {
    locale: "en",
    sensitivity: "medium",
    customTerms: ["banned-word"],
  },
});

Performance: createValidator()

For hot paths, pre-compile your configuration once.

import { createValidator } from "ugc-validator";

const fastValidator = createValidator(options);

// Reuse across many requests
const result = await fastValidator.validate(req.body);

Framework Integration

Express

import { expressMiddleware } from "ugc-validator/middleware/express";
app.post("/comment", expressMiddleware({ body: options }), handler);

NestJS

import { UgcValidatorPipe } from 'ugc-validator/middleware/nestjs';
@Post('comment')
@UsePipes(new UgcValidatorPipe(options))
async createComment(@Body() body: any) { ... }

Contributing

Built with ❤️ by Sonar Seed.

We are building the future of influencer seeding. Learn how to scale your brand at sonarseed.com.

License

MIT