sanitize review input

src/modules/review/providers/review.service.ts

@@ -15,6 +15,7 @@ import { Restaurant } from 'src/modules/restaurants/entities/restaurant.entity';
 import { ReviewStatus } from '../enums/review-status.enum';
 import { EventEmitter2 } from '@nestjs/event-emitter';
 import { ReviewCreatedEvent } from '../events/review.events';
+import { sanitizeText } from '../../utils/sanitize.util';
 
 @Injectable()
 export class ReviewService {
@@ -70,7 +71,7 @@ export class ReviewService {
       food,
       user,
       rating,
-      comment: comment || undefined,
+      comment: sanitizeText(comment) || undefined,
       positivePoints: positivePoints || undefined,
       negativePoints: negativePoints || undefined,
       status: ReviewStatus.PENDING,
@@ -145,7 +146,14 @@ export class ReviewService {
     }
 
     const oldRating = review.rating;
-    this.em.assign(review, dto);
+
+    // Sanitize comment if provided
+    const sanitizedDto = {
+      ...dto,
+      comment: dto.comment !== undefined ? sanitizeText(dto.comment) || undefined : undefined,
+    };
+
+    this.em.assign(review, sanitizedDto);
     await this.em.persistAndFlush(review);
 
     // Update food rating average if rating changed

src/modules/utils/sanitize.util.ts

@@ -0,0 +1,20 @@
+import sanitizeHtml from 'sanitize-html';
+
+/**
+ * Sanitizes user input to prevent XSS attacks and remove malicious content
+ * Allows only safe text content, removing all HTML tags and scripts
+ * @param input - The string to sanitize
+ * @returns Sanitized string with all HTML tags and scripts removed
+ */
+export function sanitizeText(input: string | undefined | null): string | undefined | null {
+    if (!input) {
+        return input;
+    }
+
+    return sanitizeHtml(input, {
+        allowedTags: [], // No HTML tags allowed
+        allowedAttributes: {}, // No attributes allowed
+        allowedSchemes: [], // No URL schemes allowed
+    }).trim();
+}
+