输入验证、消毒和服务层

Question

//userService.js function
function register(data, callback) {
    if (!data) {
        return callback(new Error('Here some error...'));
    }

    /* Sanitize and validate the data */

    /* Method #1 */
    //If not valid then call back with validationErrors
    if (notValid) {
        return callback({
            validationErrors: {
                'username': 'Username is already in use.',
                'email': 'Invalid characters.',
            }
        });
    }

    /* Method #2 */
    if (notValid) {
        return callback({
            fields: {
                //We put here a sanitized fields

            },
            validationErrors: {
                'username': 'Username is already in use.',
                'email': 'Invalid characters.',
            }
        });
    }

};


//userController.js function
// GET/POST: /register
function registerAction(request, response, next) {
    if (request.method === 'POST') {
        var registerData = {
            username: request.body['username'],
            password: request.body['password'],
            email: request.body['email'],
            firstName: request.body['firstName'],
            lastName: request.body['lastName'],
        };

        register(registerData, function(error, someDataIfSucceed) {
            if (error) {
                //Re-post the data so the user wont have to fill the form again

                //Sanitize registerData variable here.

                return response.render('register', {
                    error: error,
                    validationErrors: error.validationErrors
                });
            };

            //User registered succesfully.
            return response.render('registerSuccess');
        });

        return;
    }

    return response.render('register');
}

null

Answer 1

如果使用Express，一个有趣的选项是：

>

创建一个中间件，并使用express-validator将其用作验证层，该层基于Node-Validator。例如（有关所有验证/消毒选项，请参见节点验证器文档）：

exports.validate = function(req, res, next) {

  req.assert('username').notEmpty();
  req.assert('password').notEmpty();
  req.assert('email').isEmail();
  req.assert('firstName').len(2, 20).xss();
  req.assert('lastName').len(2, 20).xss();

  var errors = req.validationErrors(true);

  if (errors){
    res.status(400).json({ status: 'ko', errors: errors });
  }
  else {
    next();
  }

}

然后，在控制器中，只需获取经过验证的请求参数并运行注册逻辑(register函数调用和响应呈现），