阅读中文版本

Build an Input Sanitizer Service

Input Sanitizer Service — a complete walkthrough of input validation and normalization, covering schema validator, html stripper, encoding normalizer, and testing.

input_sanitizer_service/
├── src/index.ts
├── src/schema-validator.ts
├── src/html-stripper.ts
├── tests/input_sanitizer_service.test.ts
└── package.json

// Schema validator: input validation and normalization core
export function schemavalidator(input: SchemavalidatorInput): SchemavalidatorResult {
  // Build the schema validator that anchors input validation and normalization and defines the core data shape.
  return processSchemavalidator(input);
}

// HTML stripper — handles input validation and normalization Add the html stripper so
export class Htmlstripper {
  constructor(private opts: HtmlstripperOptions) {}
  async run(ctx: Context): Promise<HtmlstripperOutput> {
    return this.execute(ctx);
  }
}

// Encoding normalizer: input validation and normalization stage
export const encodingnormalizer = (next: Next) => async (req: Request) => {
  const out = await transform(req);
  return next(out);
};

// Length enforcer for input validation and normalization
export async function lengthenforcer(stream: AsyncIterable<Chunk>): Promise<Aggregate> {
  let acc = init();
  for await (const c of stream) acc = merge(acc, c);
  return acc;
}

// Audit emitter: input validation and normalization finalization
export function auditemitter(state: State): Result {
  validate(state);
  return finalize(state);
}

Project overview

This project builds a input validation and normalization system whose reason for existing is cleaning untrusted input so downstream services receive only well-formed data. The temptation in input validation and normalization is to bolt the interesting part onto a working prototype and discover the hard cases in production; this build inverts that order and treats a double-encoded payload that bypasses a single decode step and smuggles markup past the stripper as the first thing designed, not the last.

You will implement Schema validator, HTML stripper, Encoding normalizer, Length enforcer, and Audit emitter, each as a module with one responsibility and a test that proves it in isolation. The input validation and normalization pipeline is then the wiring that composes them, and the integration test is where the composition is shown to survive a double-encoded payload that bypasses a single decode step and smuggles markup past the stripper.

The walkthrough is written for a developer who has used a input validation and normalization system but has not had to make one honest. It favors explicit data shapes over clever abstractions, and it names the failure each design choice prevents rather than presenting the choice as a style preference.

Each phase ends with something observable — a schema validator that returns the right shape, a html stripper that rejects bad input, an integration test that goes green — so you can stop at any point and still have a input validation and normalization system that works for the cases covered so far.

What you will build

The finished input validation and normalization system exposes five capabilities, each with a focused test:

• Schema validator
• HTML stripper
• Encoding normalizer
• Length enforcer
• Audit emitter

Schema validator is the foundation that every later stage assumes; HTML stripper is where input validation and normalization correctness lives; Encoding normalizer handles a double-encoded payload that bypasses a single decode step and smuggles markup past the stripper; Length enforcer makes the system observable; and Audit emitter is the graceful-degradation layer that keeps overload from becoming corruption.

The build keeps the input validation and normalization logic in ordinary modules you can read in one sitting, and pulls in dependencies only for the parts that are genuinely tedious to hand-roll. That keeps the diff between the tutorial and a real codebase small, and keeps the failure modes visible in code rather than hidden behind a framework.

Architecture and data model

The system is organized around Schema validator, HTML stripper, and Encoding normalizer, with Length enforcer tying them together. Data flows as a pipeline of validators that each transform or reject an input, producing a clean value or a typed rejection.

Each component is a module with a pure interface where practical: the same input produces the same output, and side effects are pushed to the edges. That discipline is what makes the phases independently testable, because a test for Encoding normalizer does not need to stand up Schema validator and HTML stripper to exercise the interesting branch.

The data model is deliberately explicit. A pipeline of validators that each transform or reject an input, producing a clean value or a typed rejection Keeping the shape written down — in a schema, a type, or a fixture — means a change to the shape is a visible diff rather than a silent runtime shift, and it means the integration test can assert against a concrete shape instead of guessing.

Configuration and code are kept apart: the configuration says what input validation and normalization should do, the modules say how. A reviewer can change a threshold or a policy without reading the implementation, which keeps the risky changes small and lets the diff stand as the review.

The failure path through Encoding normalizer is designed before the happy path is finished, because a double-encoded payload that bypasses a single decode step and smuggles markup past the stripper is the case that distinguishes a input validation and normalization system from a demo. Every component declares what it does when its inputs are wrong, and the integration test asserts each of those declarations.

Prerequisites and dependencies

Have these ready before you install anything, so the input validation and normalization setup is not blocked by a missing tool:

• Node.js 20 LTS or later
• Familiarity with input validation and normalization fundamentals
• A local environment to run the test suite

The runtime dependencies are chosen to keep the input validation and normalization datapath legible:

• ajv (^8.17.0) — Schema validation
• sanitize-html (^2.13.0) — HTML stripping
• iconv-lite (^0.6.3) — Encoding normalization

# setup for input-sanitizer-service
pnpm init
pnpm add ajv sanitize-html iconv-lite
pnpm add -D typescript tsx vitest

Versions are pinned to a major range so the input validation and normalization install is reproducible; commit the lockfile. The schema validator reads its operational parameters from the environment and validates them at startup, so a missing value fails the boot rather than the first input validation and normalization request.

Directory structure

Keep each input validation and normalization component in its own file so it can be tested without starting the others:

input_sanitizer_service/
├── src/index.ts
├── src/schema-validator.ts
├── src/html-stripper.ts
├── tests/input_sanitizer_service.test.ts
└── package.json

Phase 1: Schema validator

Build the schema validator that anchors input validation and normalization and defines the core data shape.

// Schema validator: input validation and normalization core
export function schemavalidator(input: SchemavalidatorInput): SchemavalidatorResult {
  // Build the schema validator that anchors input validation and normalization and defines the core data shape.
  return processSchemavalidator(input);
}

After this phase the schema validator works in isolation and is covered by a unit test. The schema validator defines the data shape that every later stage assumes, so getting it right first means the later phases compile against a stable contract.

Treat the schema validator as the single source of truth for the input validation and normalization data shape. Validate inputs at the boundary and reject early, so a malformed value never reaches HTML stripper or Encoding normalizer where its effect would be harder to localize.

Phase 2: HTML stripper

Add the html stripper so input validation and normalization can cleaning untrusted input so correctly.

// HTML stripper — handles input validation and normalization Add the html stripper so
export class Htmlstripper {
  constructor(private opts: HtmlstripperOptions) {}
  async run(ctx: Context): Promise<HtmlstripperOutput> {
    return this.execute(ctx);
  }
}

After this phase the html stripper works in isolation and is covered by a unit test. This is where input validation and normalization correctness lives: the html stripper is what makes cleaning untrusted input so downstream services receive only well-formed data true, and its test is the proof.

Keep the html stripper pure where you can. A function that takes an input and returns an output is trivial to test and impossible to mock wrong; a class with hidden state is the opposite. Push side effects to the caller and keep the html stripper about the transformation.

Phase 3: Encoding normalizer

Wire the encoding normalizer to handle a double-encoded payload that without losing data.

// Encoding normalizer: input validation and normalization stage
export const encodingnormalizer = (next: Next) => async (req: Request) => {
  const out = await transform(req);
  return next(out);
};

After this phase the encoding normalizer works in isolation and is covered by a unit test. The encoding normalizer is the difference between a input validation and normalization system that works on the happy path and one that survives a double-encoded payload that bypasses a single decode step and smuggles markup past the stripper.

Design the failure before the success. Decide what encoding normalizer does when a double-encoded payload that bypasses a single decode step and smuggles markup past the stripper: reject, retry, shed, or degrade — and write that test first. A input validation and normalization system whose failure behavior is unspecified will pick one at random under pressure, and it is usually the wrong one.

Phase 4: Length enforcer

Integrate the length enforcer to make input validation and normalization observable and testable end to end.

// Length enforcer for input validation and normalization
export async function lengthenforcer(stream: AsyncIterable<Chunk>): Promise<Aggregate> {
  let acc = init();
  for await (const c of stream) acc = merge(acc, c);
  return acc;
}

After this phase the length enforcer works in isolation and is covered by a unit test. Observability is not a finishing touch; it is how you know the input validation and normalization system is doing what it claims in production.

Emit one structured event per meaningful action, with enough context to localize a failure without a second round-trip. The length enforcer is what turns “something is slow” into “the html stripper is slow for inputs matching this shape,” which is the difference between an alert and an investigation.

Phase 5: Audit emitter

Finalize the audit emitter so the input validation and normalization system degrades gracefully under overload.

// Audit emitter: input validation and normalization finalization
export function auditemitter(state: State): Result {
  validate(state);
  return finalize(state);
}

After this phase the audit emitter works in isolation and is covered by a unit test. The audit emitter is what keeps overload from becoming corruption: when the input validation and normalization system is asked for more than it can do, it degrades in a defined way instead of failing in an undefined one.

Pick a degradation strategy for audit emitter — shed, queue, or backpressure — and make it explicit in code and in a test. Leaving the behavior to chance is how a input validation and normalization traffic spike becomes a data loss incident.

Testing

Each phase has a focused test: schema validator, html stripper, and encoding normalizer are exercised in isolation, then an integration test drives the full input validation and normalization pipeline and asserts the a double-encoded payload that case is handled.

Start with unit tests that pin each component’s contract: the schema validator returns the documented shape, the html stripper transforms correctly, and the encoding normalizer fails in the documented way. These tests are fast and they localize regressions to the component that broke.

Then add an integration test that composes the components and drives a realistic input validation and normalization scenario end to end. Assert the happy path first, then deliberately trigger a double-encoded payload that bypasses a single decode step and smuggles markup past the stripper and assert the system degrades rather than corrupts. Because the components are pure where practical, the integration test stays deterministic rather than flaky.

A input validation and normalization suite must also prove the negative: bad input is rejected at the boundary, overload is shed rather than queued indefinitely, and a partial failure does not leave the system in an inconsistent state. These are the tests that catch the regressions a happy-path suite never would.

The entire input validation and normalization suite runs with no external service; every dependency is either in-process or stubbed, so every case is reproducible in CI. That is what lets the encoding normalizer failure-mode assertions live as tests rather than as a manual checklist that drifts out of date.

# run the input validation and normalization test suite
pnpm vitest run

Deployment and operations

Run at least two input validation and normalization instances behind a load balancer and share state in Redis. Set resource limits so input validation and normalization overload surfaces as backpressure rather than failure.

Run at least two stateless instances behind a load balancer, and move any shared state into a shared store so the input validation and normalization behavior is global rather than per instance. Size limits so the system sheds load before it runs out of memory, because a input validation and normalization system that OOMs under load fails in a way that is hard to reason about.

Drain on deploy: stop accepting new work, let in-flight input validation and normalization operations finish, then exit. Because the system holds no state that cannot be reconstructed, a rollout is a matter of cycling instances one at a time while watching the error rate.

When a dependency is unavailable, decide explicitly whether the input validation and normalization system fails closed or degrades. Leaving that choice to chance is how a dependency outage becomes a silent data loss, so make the choice visible in code and in a test.

Security considerations

Validate all input validation and normalization inputs at the boundary, reject oversized payloads before buffering them, and keep secrets in the environment rather than the repository.

The input validation and normalization system is a choke point, so it is the right place to reject malformed input before it reaches html stripper or encoding normalizer. Validate the shape and the size at the edge, and let the inner components assume what they receive is well-formed.

Never log secrets or full payloads; log enough to localize a failure without recording data that should not be on disk. Treat any external call as untrusted and validate its response before using it, because a input validation and normalization system that trusts its inputs blindly is one malformed response away from corruption.

Keep dependencies pinned and run an audit in CI. A transitive dependency with a known vulnerability is still a vulnerability in your input validation and normalization system, and the lockfile is what makes the audit meaningful.

Observability

Emit one structured event per input validation and normalization operation with the inputs’ shape, the outcome, and a correlation id. Track error rate and latency per component and alert on a step change rather than a single spike.

The correlation id is the thread that ties a user-visible symptom to the input validation and normalization decision and to the component log entry for the same operation. Without it, an investigation starts from a timestamp and a guess.

Watch the encoding normalizer failure rate separately from the overall error rate. A jump in encoding normalizer failures usually means a double-encoded payload that bypasses a single decode step and smuggles markup past the stripper, not a bug in html stripper, and the two have different owners and different fixes.

Chart the share of input validation and normalization operations that shed, queue, or succeed. A change in the mix points at the cause faster than an aggregate latency can, because each class has a different root.

Troubleshooting

A double-encoded payload that bypasses a single decode step and smuggles markup past the stripper. Reproduce with a minimal fixture, then add a guard test so the input validation and normalization system rejects the condition loudly.

Performance regresses under input validation and normalization load. Profile with the sampling analyzer, locate the hot path in html stripper, and add a targeted benchmark to lock the regression.

Keep the input validation and normalization dashboards separate from dependency dashboards. When an operation fails, the correlation id lets you decide in seconds whether the fault is schema validator, html stripper, or encoding normalizer, instead of guessing from a timeout.

Limitations and next steps

• Single-region; multi-region replication is out of scope.
• The schema validator is in-process and not horizontally shared by default.
• No auth layer; assume deployment behind an edge that enforces identity.

The input validation and normalization system is single-region by design; extending to multi-region means making schema validator shareable across regions, which is a real change to the consistency model rather than a config flag. The encoding normalizer is in-process, which is correct for one instance but must move to a shared store before scaling out.

There is no authentication or authorization layer; the system assumes it is deployed behind an edge that enforces identity. Adding one is straightforward but out of scope for this build, and doing it here would distract from the input validation and normalization correctness that is the point.

The natural next step, once the input validation and normalization pipeline is trusted in production, is to add a short-TTL cache for idempotent reads and a richer length enforcer that exports histograms rather than counters. Both are additive and neither changes the contracts this build establishes.