Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

Remove or wire up unused dependencies: `hpp` and `express-mongo-sanitize` are declared but never imported

Open
  • Is something wrong?
#276 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
3/5
Estimated time
Half a day
Newbie friendliness
62/100
Issue type
Refactor
Clarity
Mostly clear
Activity status
Active
Tech stack
express, nodejs, typescript
Domain
backend, security

Research direction

Start with git log -S on package.json for hpp and express-mongo-sanitize to establish intent, then read the middleware chain in src/main.ts (helmet, SanitizePipe, createGlobalValidationPipe). If the packages are dead, remove them and regenerate package-lock.json; if intended, apply hpp() and mongoSanitize() before the pipes and add a test for duplicate query keys or $where operators. Done means the intent is recorded in the PR, npm ci, npx tsc --noEmit and npm test pass, and no unused entry remains for this pair.

Written by the indexing model from the issue text.

Description

good first issue help wanted security tooling

Problem

package.json declares HTTP-parameter-pollution and NoSQL-injection protections that are never used anywhere in src/:

"express-mongo-sanitize": "^2.2.0",
"hpp": "^0.2.3",

A scan of every TypeScript file under src/ for hpp and mongoSanitize returns zero matches for both. They are installed in production dependencies but not applied.

src/main.ts sets up a global middleware/pipe chain — helmet (line 60), a favicon handler (63-69), SanitizePipe (75), createGlobalValidationPipe() (76), and CORS (80) — and neither library appears in it.

For contrast, the protections that are wired up: helmet with a full CSP (src/config/helmet.config.ts), a SanitizePipe using class-sanitizer (src/common/pipes/sanitize.pipe.ts), x-powered-by disabled (line 83), and strict validation.

Why it matters

Two possible states, both worth fixing:

  • Dead dependencies. They add install time, image size, and supply-chain surface for no benefit — every dependency is code an attacker could target and maintainers must track. npm audit will also report on them.
  • Intended but forgotten protections. If someone added these deliberately and never wired them up, then the API is missing HTTP parameter pollution defence and NoSQL operator sanitisation, and the install step created a false sense of coverage.

Which one it is determines the fix, so establish that first.

Suggested Direction

  1. Determine intent. Check git history for why these were added. If there is no rationale, they are dead weight.
  2. If dead: remove them from package.json and regenerate package-lock.json. Also remove the path and crypto stub packages if not already handled by the dependency-alignment issue.
  3. If intended: wire them up in src/main.ts alongside the existing middleware, ordered deliberately: 
    app.use(hpp());
app.use(mongoSanitize());
    Place them before SanitizePipe and the validation pipe so polluted or operator-laden parameters are rejected before validation.
  4. Verify no regression. The global ValidationPipe sets forbidNonWhitelisted: true, so extra query parameters already 400 — but hpp protects against duplicate-key confusion which the pipe does not catch.

Constraints

  • hpp operates on req.query and mutates it; confirm it does not break legitimate repeated query parameters before applying.
  • express-mongo-sanitize was unmaintained at one point — verify the installed version (2.2.x) is current and compatible with Express 5, which the repo uses.
  • If removing, ensure npm ci still resolves and CI passes.

Acceptance Criteria

  • The intent of each dependency is established and recorded in the PR.
  • Either the dependency is removed and the lockfile regenerated, or it is applied in src/main.ts with a comment on ordering.
  • A test covers the behaviour being protected (duplicate query keys or __proto__/$where operators).
  • npm ci, npx tsc --noEmit, and npm test pass.
  • No unused entry remains in dependencies for this pair.
Dominant language
TypeScript
Stars
7
Forks
55
Avg merge
1d 17h
Merged PRs (30d)
5

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from SourceXXL/alian_structure-api

All issues in SourceXXL/alian_structure-api

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.