title: How to Properly Sanitize NestJS Input?
body: <p>I’m asking this as I can’t seem to get a straight answer.</p>
  <p>So, NestJS has a very elegant way of handling validation by using decorators. That is, you define DTO classes with properties you expect, and annotate them with class-validator decorators. For example, assume we have a route that accepts input from a contact form.</p>
  <pre><code>class ContactInfoDTO {
       @IsString()
       @IsNotEmpty()
       name: string
       
       @IsEmail()
       email: string
       
       @IsString()
       @IsNotEmpty
       subject: string
  
       @IsString()
       @IsNotEmpty()
       body: string
  
  }
  </code></pre>
  <p>This works great for validation. If I enter an invalid email, it will reject it as expected. But, here’s my question. What about input Sanitization? Say, for example, I enter a some JavaScript in the body parameter? Like, say, my body looks like this:</p>
  <pre><code>body: “Hello &lt;script&gt;//some malicious code here&lt;/script&gt;”
  </code></pre>
  <p>Now, this is still accepted. Even though the script tags are not converted to HTML entities, which does pose a bit of a security risk.</p>
  <p>So, my question is does NestJS have any kind of built-in Sanitization mechanisms? Is there proper documentation on this? Because I can’t really find any, despite this kind of thing being very important in the context of web development.</p>
  <p>What’s the best practice for doing input Sanitization in NestJS?</p>