3287298592
- Add SanitizeHtmlService (whitelist: b, i, br, p, a) using sanitize-html. - Force rel="noopener noreferrer nofollow" and target="_blank" on anchors. - Restrict URL schemes to http/https/mailto/tel; drop javascript: links. - Wire sanitizer into CreateInquiryHandler before InquiryEntity.createNew. - Register provider in InquiriesModule. - Add unit tests: 7 for the service + 2 handler-level XSS payload tests (<script>...</script> and <img onerror=...> stripped). Defense-in-depth complement to global SanitizeInputMiddleware so internal command paths bypassing HTTP middleware (queues, imports) stay safe. Co-Authored-By: Paperclip <noreply@paperclip.ing>
31 lines
1.3 KiB
TypeScript
31 lines
1.3 KiB
TypeScript
import { Module } from '@nestjs/common';
|
|
import { CqrsModule } from '@nestjs/cqrs';
|
|
import { CreateInquiryHandler } from './application/commands/create-inquiry/create-inquiry.handler';
|
|
import { MarkInquiryReadHandler } from './application/commands/mark-inquiry-read/mark-inquiry-read.handler';
|
|
import { GetInquiriesByAgentHandler } from './application/queries/get-inquiries-by-agent/get-inquiries-by-agent.handler';
|
|
import { GetInquiriesByListingHandler } from './application/queries/get-inquiries-by-listing/get-inquiries-by-listing.handler';
|
|
import { SanitizeHtmlService } from './application/services/sanitize-html.service';
|
|
import { INQUIRY_REPOSITORY } from './domain/repositories/inquiry.repository';
|
|
import { PrismaInquiryRepository } from './infrastructure/repositories/prisma-inquiry.repository';
|
|
import { InquiriesController } from './presentation/controllers/inquiries.controller';
|
|
|
|
const CommandHandlers = [CreateInquiryHandler, MarkInquiryReadHandler];
|
|
|
|
const QueryHandlers = [
|
|
GetInquiriesByListingHandler,
|
|
GetInquiriesByAgentHandler,
|
|
];
|
|
|
|
@Module({
|
|
imports: [CqrsModule],
|
|
controllers: [InquiriesController],
|
|
providers: [
|
|
{ provide: INQUIRY_REPOSITORY, useClass: PrismaInquiryRepository },
|
|
SanitizeHtmlService,
|
|
...CommandHandlers,
|
|
...QueryHandlers,
|
|
],
|
|
exports: [INQUIRY_REPOSITORY],
|
|
})
|
|
export class InquiriesModule {}
|