Node js remove sensitive data from object before sending it

Question

I want to remove some sensitive data from the array before sending to the client (to render all the users), but for some reason I can't actually remove them! I need to remove some usernames, passwords, emails etc. Is there something with splice() ? Thank you for helping me!

app.get('/users', function(req, res){ Users.find{}, function(err, usersArray){
  for(var a = 0; a < usersArray.length; a++){
    usersArray[a].userData.username.splice(0, 1); // here's my error
    usersArray[a].userData.email.splice(0, 1); // end here
    usersArray[a].userData.password.splice(0, 1); // and also here
    ...
  }
  res.render('users.ejs', {
    // and the variables go here...
  })

}

By the way, the error I get is "TypeError: undefined is not a function". Thanks again!

Strings do not have a splice method, see stackoverflow.com/questions/20817618/… — LeartS
– LeartS, Commented Dec 22, 2015 at 14:53
@LeartS I presume the username, etc. objects are arrays of usernames, etc., not strings. (It wouldn't make sense to chop off the first char of a string to censor something, anyway.) — tckmn
– tckmn, Commented Dec 22, 2015 at 14:54
How are we supposed to help you if you don't tell us what the structure of the entries in usersArray is? — T.J. Crowder
– T.J. Crowder, Commented Dec 22, 2015 at 14:54
@Doorknob冰 I think you presume wrong, the error suggests he's trying to use splice on an object that does not have the splice method. The array is usersArray and he gets the single user object by indexing it. — LeartS
– LeartS, Commented Dec 22, 2015 at 14:56
@LeartS Ah, you're right; I didn't see the last line of the question. — tckmn
– tckmn, Commented Dec 22, 2015 at 14:57

T.J. Crowder · Accepted Answer · 2015-12-22 16:16:03Z

I'll take a wild guess that you want to remove username, email, and password entirely. If so, you're looking for delete, which removes properties from objects:

app.get('/users', function(req, res){ Users.find{}, function(err, usersArray){
  for(var a = 0; a < usersArray.length; a++){
    var userData = usersArray[a].userData;
    delete userData.username;
    delete userData.email;
    delete userData.password;
    ...
  }
  res.render('users.ejs', {
    // and the variables go here...
  })
}

If those propeties are non-configurable, delete can't remove them, and you have to make do with setting their values to undefined:

app.get('/users', function(req, res){ Users.find{}, function(err, usersArray){
  for(var a = 0; a < usersArray.length; a++){
    var userData = usersArray[a].userData;
    userData.username = undefined;
    userData.email = undefined;
    userData.password = undefined;
    ...
  }
  res.render('users.ejs', {
    // and the variables go here...
  })
}

If they're both non-configurable and non-writable, you'll have to create replacement objects instead.

Live Example using delete:

var usersArray = [{
  userData: {
    name: "User 1", // Something to have left after we remove the others
    username: "user1",
    email: "[email protected]",
    password: "pa$$word"
  }
}, {
  userData: {
    name: "User 2",
    username: "user2",
    email: "[email protected]",
    password: "pa$$word"
  }
}, {
  userData: {
    name: "User 3",
    username: "user3",
    email: "[email protected]",
    password: "pa$$word"
  }
}];
snippet.log("Before: " + JSON.stringify(usersArray, null, 2));
for (var a = 0; a < usersArray.length; a++) {
  var userData = usersArray[a].userData;
  delete userData.username;
  delete userData.email;
  delete userData.password;
}
snippet.log("After: " + JSON.stringify(usersArray, null, 2));

<!-- Script provides the `snippet` object, see http://meta.stackexchange.com/a/242144/134069 -->
<script src="//tjcrowder.github.io/simple-snippets-console/snippet.js"></script>

Live Example with non-configurable properties using undefined:

function makeUserData(name, username, email, password) {
  var ud = {name: name};
  Object.defineProperty(ud, "username", {
    enumerable: true,
    configurable: false,
    writable: true,
    value: username
  });
  Object.defineProperty(ud, "email", {
    enumerable: true,
    configurable: false,
    writable: true,
    value: email
  });
  Object.defineProperty(ud, "password", {
    enumerable: true,
    configurable: false,
    writable: true,
    value: password
  });
  return ud;
}
var usersArray = [{
  userData: makeUserData("User 1", "user1", "[email protected]", "pa$$word")
},{
  userData: makeUserData("User 2", "user2", "[email protected]", "pa$$word")
},{
  userData: makeUserData("User 3", "user3", "[email protected]", "pa$$word")
}];
snippet.log("Before: " + JSON.stringify(usersArray, null, 2));
for (var a = 0; a < usersArray.length; a++) {
  var userData = usersArray[a].userData;
  delete userData.username;
  delete userData.email;
  delete userData.password;
}
snippet.log("After delete: " + JSON.stringify(usersArray, null, 2));
for (var a = 0; a < usersArray.length; a++) {
  var userData = usersArray[a].userData;
  userData.username = undefined;
  userData.email = undefined;
  userData.password = undefined;
}
snippet.log("After assigning undefined: " + JSON.stringify(usersArray, null, 2));

<!-- Script provides the `snippet` object, see http://meta.stackexchange.com/a/242144/134069 -->
<script src="//tjcrowder.github.io/simple-snippets-console/snippet.js"></script>

When I have the code like this, it seems to run with no errors, but it still won't work! I also console.log() the array and it still has all the sensitive data in it. Just for clarification userData is an array, the rest of them (username, email, password etc) are just strings that I have to remove.
@JimTheGreek: Don't know what to tell you, if those properties exist on those objects and they're not non-configurable, delete will remove them. If they're non-configurable, you can set them to undefined.
@JimTheGreek: And if they're non-writable, you'll have to create whole new objects with just the properties you want.

Collectives™ on Stack Overflow

Node js remove sensitive data from object before sending it

1 Answer 1

3 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

3 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related