xss-clean | Middleware to sanitize user input | Runtime Evironment library

I just solve this issue by correcting the RxJS version to 7.4.0. I hope this can solve others issue as well.

You could simply modify the middleware from your own node_modules folder, and in the source-code file where it begins to parse the request object, you could add conditional logic that checks if the request object meets the conditions you're checking for-- whether it's a specific request or contains the specific data within the request-- and then decide whether or not you use the sanitization function on the request object.

[Unmodified] xss-clean/src/index.js:

You request must contain the header Content-Type: application/json. And the attribute names in the JSON body must be quoted:

Helmet maintainer here.

This is happening because of something called Content Security Policy, which Helmet sets by default. To solve your problem, you will need to configure Helmet's CSP.

MDN has a good documentation about CSP which I would recommend reading for background. After that, take a look at Helmet's README to see how to configure its CSP component.

To give some help specific to this question: this error is telling you that the script-src directive of your CSP does not allow inline JavaScript, and so it was blocked.

This is considered "inline" JavaScript:

You have complete control using the helmet middleware you mentioned.

The reference docs are clear about setting up your CSP.

Once set, you can always evaluate the strength your CSP with a validator such as this one.

From the docs:

If no directives are supplied, the following policy is set (whitespace added for readability):

If the library does not have many TypeScript users, chances are that no published types exist. In that case you can add your own to whatever degree of detail you wish.

You can create a type definition file, e.g. xss-clean.d.ts:

Your server declaration must be inside the else block.

So you must change to:

Try this way: