diff --git a/backend/middleware/profanity.js b/backend/middleware/profanity.js index 28aecff..eda62d9 100644 --- a/backend/middleware/profanity.js +++ b/backend/middleware/profanity.js @@ -21,17 +21,45 @@ function scanValue(value) { return false; } +function removeKeys(obj, keys) { + if (!obj || typeof obj !== "object") return; + + if (Array.isArray(obj)) { + obj.forEach((v) => removeKeys(v, keys)); + return; + } + + keys.forEach((k) => { + delete obj[k]; + }); + + Object.values(obj).forEach((v) => removeKeys(v, keys)); +} + export function profanity(req, res, next) { + const skipProfanityPaths = [ + "/placesAPI/search", + "/placesAPI/cityAutocomplete", + "/activities/create", + "/activities/delete", + "/activities/update", + ]; + + const cleanUrl = req.originalUrl.split("?")[0]; + + if (skipProfanityPaths.some((p) => cleanUrl.startsWith(p))) { + return next(); + } + if (req.method === "GET" || req.method === "HEAD") return next(); if (!req.body || typeof req.body !== "object") return next(); - const ignoredKeys = ["customPhoto", "photo", "pfp"]; + const bodyToScan = structuredClone(req.body); - const filtered = Object.fromEntries( - Object.entries(req.body).filter(([key]) => !ignoredKeys.includes(key)) - ); + const ignoredKeys = ["customPhoto", "photo", "pfp"]; + removeKeys(bodyToScan, ignoredKeys); - if (scanValue(filtered)) { + if (scanValue(bodyToScan)) { return res.status(400).json({ error: "Profanity detected." }); }