AI API Proxy
Input Sanitization

// Input sanitization middleware
function sanitizeInput(input) {
  let sanitized = input;
  
  // 1. Normalize Unicode
  sanitized = sanitized.normalize('NFKC');
  
  // 2. Remove null bytes
  sanitized = sanitized.replace(/\0/g, '');
  
  // 3. Escape HTML entities
  sanitized = sanitized
    .replace(/&/g, '&')
    .replace(/, '<')
    .replace(/>/g, '>');
  
  // 4. Truncate to max length
  const MAX_LEN = 8192;
  if (sanitized.length > MAX_LEN) {
    sanitized = sanitized.substring(0, MAX_LEN);
  }
  
  return sanitized;
}

import re

def detect_injection(text):
    """Detect common injection patterns"""
    patterns = [
        # SQL Injection
        r"(\'|\"|;|--|\/\*|\*\/)",
        r"(union|select|insert|delete|drop)",
        
        # XSS
        r"]*>.*?",
        r"javascript:",
        
        # Command Injection
        r"[;&|`$(){}]",
        
        # Prompt Injection
        r"ignore (previous|all) instructions",
        r"system:\s*you are",
    ]
    
    for pattern in patterns:
        if re.search(pattern, text, re.I):
            return True  # Injection detected!
    
    return False