构建输入净化服务

项目概述

本项目实现一个面向 input validation and normalization 的完整系统，核心要解决的问题是 cleaning untrusted input so downstream services receive only well-formed data。整体由 Schema validator、HTML stripper、Encoding normalizer、Length enforcer、Audit emitter 五个模块组成，每个模块单一职责、可独立测试，最后通过集成测试验证端到端正确性。设计上把 a double-encoded payload that bypasses a single decode step and smuggles markup past the stripper 作为第一类需求先行处理，而非事后再补。

架构与关键决策

数据模型为 a pipeline of validators that each transform or reject an input, producing a clean value or a typed rejection。Schema validator 定义其余阶段共同依赖的数据形状并在边界处校验输入；HTML stripper 承载 input validation and normalization 的正确性逻辑；Encoding normalizer 专门处理 a double-encoded payload that bypasses a single decode step and smuggles markup past the stripper，在失败路径上给出明确的拒绝、重试或降级策略；Length enforcer 提供可观测性，每次操作输出带关联 id 的结构化事件；Audit emitter 在过载时按既定方式降级，避免过载演变为数据损坏。配置与代码分离，使风险变更可经 diff 审阅。

实施与测试

按五个阶段依次实现 Schema validator、HTML stripper、Encoding normalizer、Length enforcer、Audit emitter，每阶段配套聚焦单测。集成测试组合各模块并驱动真实 input validation and normalization 场景：先验证正常路径，再刻意触发 a double-encoded payload that bypasses a single decode step and smuggles markup past the stripper 并断言系统降级而非损坏。所有依赖均在进程内或被桩替换，用例在 CI 中确定可复现。

限制与后续

• 单区域设计，多区域复制超出范围。
• Schema validator 默认进程内，未水平共享。
• 无鉴权层，假定部署在强制身份的边缘之后。

代码示例

# setup for input-sanitizer-service
pnpm init
pnpm add ajv sanitize-html iconv-lite
pnpm add -D typescript tsx vitest

input_sanitizer_service/
├── src/index.ts
├── src/schema-validator.ts
├── src/html-stripper.ts
├── tests/input_sanitizer_service.test.ts
└── package.json

// Schema validator: input validation and normalization core
export function schemavalidator(input: SchemavalidatorInput): SchemavalidatorResult {
  // Build the schema validator that anchors input validation and normalization and defines the core data shape.
  return processSchemavalidator(input);
}

// HTML stripper — handles input validation and normalization Add the html stripper so
export class Htmlstripper {
  constructor(private opts: HtmlstripperOptions) {}
  async run(ctx: Context): Promise<HtmlstripperOutput> {
    return this.execute(ctx);
  }
}

// Encoding normalizer: input validation and normalization stage
export const encodingnormalizer = (next: Next) => async (req: Request) => {
  const out = await transform(req);
  return next(out);
};

// Length enforcer for input validation and normalization
export async function lengthenforcer(stream: AsyncIterable<Chunk>): Promise<Aggregate> {
  let acc = init();
  for await (const c of stream) acc = merge(acc, c);
  return acc;
}

// Audit emitter: input validation and normalization finalization
export function auditemitter(state: State): Result {
  validate(state);
  return finalize(state);
}

# run the input validation and normalization test suite
pnpm vitest run