Option for retrieve the body before sanitized

[goffxnca]

Hi Fiznool, Are there any options available for retrieve the req.body before it got sanitized, My use-case is that I want to log the shape of data that malicious user try to perform on my site, I have tried the option: dryRun:true though and I can access the version before the payload(req.body) being cleaned which is great, however with that DryRun, the whole sanitization proces is cancelled an what I receive at the route middleware function is look the same as when you request it on postman. Any help?

[fiznool]

Maybe another piece of middleware higher up in the chain? For example:

const express = require('express');
const bodyParser = require('body-parser');
const mongoSanitize = require('express-mongo-sanitize');

const app = express();

app.use(bodyParser.urlencoded({ extended: true }));
app.use(bodyParser.json());

app.use((req, res, next) => {
  console.log(res.body);
  next();
});


app.use(mongoSanitize());

[goffxnca]

Yes, doing that way gonna work fine, however with that middleware on top of mongoSanitize, I have to log the incoming body data on every request and there is no decision path or state to check if the body is dirtied on that new function coz all of that logics are performed by your libs and I mean the signal should be emitted from there, It would be nice if you can provide some more flexibility by allows registering callback function sth like preSanitize & PostSanitize. (This is not feature request though just asking incase it might useful for others)
Regards

[Zirafnik]

@fiznool Hey, I am also looking for an option to do this.

I want to sanitize all requests, however, if there is a malicious request and onSanitize fires, I want to be able to access the malicious request before it is sanitized. Accessing a clean request has no additional value.

If I use dryRun: true, then I get access to the malicious req in onSanitize, however, as mentioned above, this stops the sanitization process (which is conflicting with docs, where it says for dryRun option: 'This req will be sanitized' -> I suppose the proper verb should be 'would').

My specific use case is: If a malicious request is sent, I want to log it and be notified, so I can check it out.
The only way to do that currently is by running the middleware two times: first with dryRun: true, the other without.