{"_id":"hpp","_rev":"29-2ac96ec5d6c9369195aaa4975d0c38b5","name":"hpp","description":"Express middleware to protect against HTTP Parameter Pollution attacks","dist-tags":{"latest":"0.2.3"},"versions":{"0.0.1":{"name":"hpp","version":"0.0.1","description":"Express/Connect middleware to protect against HTTP Parameter Pollution attacks","keywords":["hpp","http","parameter","pollution","attack","security"],"homepage":"https://github.com/analog-nico/hpp","bugs":{"url":"https://github.com/analog-nico/hpp/issues"},"license":"ISC","author":{"name":"Nicolai Kamenzky","url":"https://github.com/analog-nico"},"main":"./lib/index.js","repository":{"type":"git","url":"https://github.com/analog-nico/hpp.git"},"scripts":{"test":"gulp ci"},"dependencies":{"lodash":"^3.3.1","type-is":"^1.6.0"},"engines":{"node":">=0.10.0"},"devDependencies":{"body-parser":"^1.12.0","chai":"^2.1.1","chalk":"^1.0.0","express":"^4.12.2","gulp":"^3.8.11","gulp-coveralls":"^0.1.3","gulp-istanbul":"^0.6.0","gulp-jshint":"^1.9.2","gulp-mocha":"^2.0.0","jshint-stylish":"^1.0.1","request-promise":"^0.4.0","rimraf":"^2.3.1","run-sequence":"^1.0.2"},"gitHead":"2e45d68cd6470f2e2d77eebdfe5c7b93853904cf","_id":"hpp@0.0.1","_shasum":"2d8136de36b0ae33563d15fe99be1539473923c6","_from":".","_npmVersion":"1.4.28","_npmUser":{"name":"analog-nico","email":"nicolai.kamenzky@testrails.org"},"maintainers":[{"name":"analog-nico","email":"nicolai.kamenzky@testrails.org"}],"dist":{"shasum":"2d8136de36b0ae33563d15fe99be1539473923c6","tarball":"https://registry.npmjs.org/hpp/-/hpp-0.0.1.tgz","integrity":"sha512-Tx+qeNT6gPq/0CuX7tzmyv9+tzqhbzIEMqdX92poyONwi57Fr4X59+xc29NwpW4v8TcZytm5jUXRp9eQHBDP1w==","signatures":[{"keyid":"SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA","sig":"MEQCIBHnWHw3eVq2ifEl84WFha4Zr4BxQrx1L30SsRVEyap3AiA7Vx9xP0On4UjmdNvQg9O5g2OMyFEf2N2ycC/VzIwR/g=="}]},"directories":{}},"0.1.0":{"name":"hpp","version":"0.1.0","description":"Express/Connect middleware to protect against HTTP Parameter Pollution attacks","keywords":["hpp","http","parameter","pollution","attack","security"],"homepage":"https://github.com/analog-nico/hpp","bugs":{"url":"https://github.com/analog-nico/hpp/issues"},"license":"ISC","author":{"name":"Nicolai Kamenzky","url":"https://github.com/analog-nico"},"main":"./lib/index.js","repository":{"type":"git","url":"https://github.com/analog-nico/hpp.git"},"scripts":{"test":"gulp ci"},"dependencies":{"lodash":"3.6.x","type-is":"1.6.x"},"engines":{"node":">=0.10.0"},"devDependencies":{"body-parser":"1.12.x","chai":"2.2.x","chalk":"1.0.x","express":"4.12.x","gulp":"3.8.x","gulp-coveralls":"0.1.x","gulp-istanbul":"0.8.x","gulp-jshint":"1.10.x","gulp-mocha":"2.0.x","jshint-stylish":"1.0.x","request-promise":"0.4.x","rimraf":"2.3.x","run-sequence":"1.0.x"},"gitHead":"7a4ce6ca032abbc76504f0448b958cec34e7f2e9","_id":"hpp@0.1.0","_shasum":"b85a800a5b6c6f264a79594c533db4b2d3f51c18","_from":".","_npmVersion":"1.4.28","_npmUser":{"name":"analog-nico","email":"nicolai.kamenzky@testrails.org"},"maintainers":[{"name":"analog-nico","email":"nicolai.kamenzky@testrails.org"}],"dist":{"shasum":"b85a800a5b6c6f264a79594c533db4b2d3f51c18","tarball":"https://registry.npmjs.org/hpp/-/hpp-0.1.0.tgz","integrity":"sha512-iqgxPkpPe/MZNK+btBq5nRfe4DlQx8alL7gUHTD4imjcCA43evvQbkkp0bsaqkzZ8IAkVy4gU5JsWvcTUzi/SQ==","signatures":[{"keyid":"SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA","sig":"MEUCIQDe5nmlhEy4wdhb2SjfeT6WNUPGD4iTJnjJJk7l7JFOHgIgMohnlS9VamTMhFrAj6Y1/q2DWpKnEI7+1Nn6aFOqQ8Y="}]},"directories":{}},"0.1.1":{"name":"hpp","version":"0.1.1","description":"Express middleware to protect against HTTP Parameter Pollution attacks","keywords":["hpp","http","parameter","pollution","attack","security"],"homepage":"https://github.com/analog-nico/hpp","bugs":{"url":"https://github.com/analog-nico/hpp/issues"},"license":"ISC","author":{"name":"Nicolai Kamenzky","url":"https://github.com/analog-nico"},"main":"./lib/index.js","repository":{"type":"git","url":"https://github.com/analog-nico/hpp.git"},"scripts":{"test":"gulp ci"},"dependencies":{"lodash":"3.7.x","type-is":"1.6.x"},"engines":{"node":">=0.10.0"},"devDependencies":{"body-parser":"1.12.x","chai":"2.2.x","chalk":"1.0.x","express":"4.12.x","gulp":"3.8.x","gulp-coveralls":"0.1.x","gulp-istanbul":"0.8.x","gulp-jshint":"1.10.x","gulp-mocha":"2.0.x","jshint-stylish":"1.0.x","request-promise":"0.4.x","rimraf":"2.3.x","run-sequence":"1.0.x"},"gitHead":"07113fc1497fdd71e7514b392424c2dbfa92c4d5","_id":"hpp@0.1.1","_shasum":"7572d26cc448195e21d6baa1571dcd937e52b62a","_from":".","_npmVersion":"1.4.28","_npmUser":{"name":"analog-nico","email":"nicolai.kamenzky@testrails.org"},"maintainers":[{"name":"analog-nico","email":"nicolai.kamenzky@testrails.org"}],"dist":{"shasum":"7572d26cc448195e21d6baa1571dcd937e52b62a","tarball":"https://registry.npmjs.org/hpp/-/hpp-0.1.1.tgz","integrity":"sha512-9GBiIJOSrW/0aO2Whn+XmPKhxYpsL11ms6GMstcIpGYJVHy/opvxVLyOz0t7OBNw8rnFNgNL9tpkyQUTKWjxmA==","signatures":[{"keyid":"SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA","sig":"MEUCIQD204VC0ZRgOXNUIV9nvnMq4oMtok5gZUydWUCfulXSEQIgZ7kKzl/zo884rm6szZ7b72oHFzajNhIH6Hd4ShOYVwU="}]},"directories":{}},"0.1.2":{"name":"hpp","version":"0.1.2","description":"Express middleware to protect against HTTP Parameter Pollution attacks","keywords":["hpp","http","parameter","pollution","attack","security"],"homepage":"https://github.com/analog-nico/hpp","bugs":{"url":"https://github.com/analog-nico/hpp/issues"},"license":"ISC","author":{"name":"Nicolai Kamenzky","url":"https://github.com/analog-nico"},"main":"./lib/index.js","repository":{"type":"git","url":"https://github.com/analog-nico/hpp.git"},"scripts":{"test":"gulp ci"},"dependencies":{"lodash":"3.8.x","type-is":"1.6.x"},"engines":{"node":">=0.10.0"},"devDependencies":{"body-parser":"1.12.x","chai":"2.3.x","chalk":"1.0.x","express":"4.12.x","gulp":"3.8.x","gulp-coveralls":"0.1.x","gulp-istanbul":"0.9.x","gulp-jshint":"1.10.x","gulp-mocha":"2.0.x","jshint-stylish":"1.0.x","request-promise":"0.4.x","rimraf":"2.3.x","run-sequence":"1.1.x"},"gitHead":"c2be8071d411f00bcf7f53e25d98cf0ee648bbae","_id":"hpp@0.1.2","_shasum":"765519e52128914807688a2d7475da0821b53c0c","_from":".","_npmVersion":"1.4.28","_npmUser":{"name":"analog-nico","email":"nicolai.kamenzky@testrails.org"},"maintainers":[{"name":"analog-nico","email":"nicolai.kamenzky@testrails.org"}],"dist":{"shasum":"765519e52128914807688a2d7475da0821b53c0c","tarball":"https://registry.npmjs.org/hpp/-/hpp-0.1.2.tgz","integrity":"sha512-InE9IJqCCPD01c0edEv+BPzicU0CH9utRf9WuyQHjGZz7chQl7DaIgQu0I2mr/9bGTPYHrNkeaWYRnjJycWdsw==","signatures":[{"keyid":"SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA","sig":"MEUCIF887SvtiuigMOlNwj74+aqpkAdf8gz/IM1ZzlpogXGcAiEA7d+vH4jDXBG0CrtJ5E6axjuARaDOy+e3nQ/Oe89WyCY="}]},"directories":{}},"0.2.0":{"name":"hpp","version":"0.2.0","description":"Express middleware to protect against HTTP Parameter Pollution attacks","keywords":["hpp","http","parameter","pollution","attack","security"],"homepage":"https://github.com/analog-nico/hpp","bugs":{"url":"https://github.com/analog-nico/hpp/issues"},"license":"ISC","author":{"name":"Nicolai Kamenzky","url":"https://github.com/analog-nico"},"main":"./lib/index.js","repository":{"type":"git","url":"https://github.com/analog-nico/hpp.git"},"scripts":{"test":"gulp ci"},"dependencies":{"lodash":"^3.9.1","type-is":"^1.6.2"},"engines":{"node":">=0.10.0"},"devDependencies":{"body-parser":"^1.12.4","chai":"^2.3.0","chalk":"^1.0.0","express":"^4.12.4","gulp":"^3.8.11","gulp-coveralls":"^0.1.4","gulp-istanbul":"^0.9.0","gulp-jshint":"^1.11.0","gulp-mocha":"^2.1.0","jshint-stylish":"^1.0.2","present":"0.0.6","request-promise":"^0.4.2","rimraf":"^2.3.4","run-sequence":"^1.1.0"},"gitHead":"8ea821ca2c77f96f02e8db4846c9b43d5156ba0d","_id":"hpp@0.2.0","_shasum":"b93e2b1ea579a6c1bedb3cfed92bbcf3b0cec7cf","_from":".","_npmVersion":"1.4.28","_npmUser":{"name":"analog-nico","email":"nicolai.kamenzky@testrails.org"},"maintainers":[{"name":"analog-nico","email":"nicolai.kamenzky@testrails.org"}],"dist":{"shasum":"b93e2b1ea579a6c1bedb3cfed92bbcf3b0cec7cf","tarball":"https://registry.npmjs.org/hpp/-/hpp-0.2.0.tgz","integrity":"sha512-/HTHwhc8xqwiMDPkHRX8UJOYm1WBOE1AzJlmtpxoRvM5lX2NCFbNeIipahd7CmIWK66/qRO1JMxqDnAd5kDfsA==","signatures":[{"keyid":"SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA","sig":"MEQCIHsob3BImP5ad7U5AbdXVVezrGYHAAj0nK+1IAMq/jiYAiBNNGWNetbrPZ8zf5I0w1aXA/ITCS5RAjkwnn9p8VrLhQ=="}]},"directories":{}},"0.2.1":{"name":"hpp","version":"0.2.1","description":"Express middleware to protect against HTTP Parameter Pollution attacks","keywords":["hpp","http","parameter","pollution","attack","security"],"homepage":"https://github.com/analog-nico/hpp","bugs":{"url":"https://github.com/analog-nico/hpp/issues"},"license":"ISC","author":{"name":"Nicolai Kamenzky","url":"https://github.com/analog-nico"},"main":"./lib/index.js","repository":{"type":"git","url":"git+https://github.com/analog-nico/hpp.git"},"scripts":{"test":"gulp ci"},"dependencies":{"lodash":"^4.7.0","type-is":"^1.6.12"},"engines":{"node":">=0.10.0"},"devDependencies":{"body-parser":"^1.15.0","chai":"^3.5.0","chalk":"^1.1.3","express":"^4.13.4","gulp":"^3.9.1","gulp-coveralls":"^0.1.4","gulp-istanbul":"^0.10.3","gulp-jshint":"^2.0.0","gulp-mocha":"^2.2.0","jshint":"^2.9.1","jshint-stylish":"^2.1.0","present":"0.0.6","request-promise":"^2.0.1","rimraf":"^2.5.2","run-sequence":"^1.1.5"},"gitHead":"204df7585a0a071c9e2f5d2c8741bd0531515b94","_id":"hpp@0.2.1","_shasum":"e103d0480397edfd50777be4ad735596286929cd","_from":".","_npmVersion":"2.15.3","_nodeVersion":"4.4.2","_npmUser":{"name":"analog-nico","email":"nicolai.kamenzky@testrails.org"},"maintainers":[{"name":"analog-nico","email":"nicolai.kamenzky@testrails.org"}],"dist":{"shasum":"e103d0480397edfd50777be4ad735596286929cd","tarball":"https://registry.npmjs.org/hpp/-/hpp-0.2.1.tgz","integrity":"sha512-jvHkoyN6ARWhqsbjy8WYrnV32QMX6/cRjkZqKt+sAq2Fdbap1SOJijMkFkn6Ie/jZw43zOa0aB2j5S23JgykeQ==","signatures":[{"keyid":"SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA","sig":"MEYCIQDBK9ce+ifOD1ybQNw6WWrtOaan1Mf07cl9PLXbvtdpuQIhAIYLbXRn5+LDlyKtlmOcARRSPPEQxBhDgqGumHGDs/FZ"}]},"_npmOperationalInternal":{"host":"packages-12-west.internal.npmjs.com","tmp":"tmp/hpp-0.2.1.tgz_1459751936777_0.5152505985461175"},"directories":{}},"0.2.2":{"name":"hpp","version":"0.2.2","description":"Express middleware to protect against HTTP Parameter Pollution attacks","keywords":["hpp","http","parameter","pollution","attack","security"],"homepage":"https://github.com/analog-nico/hpp","bugs":{"url":"https://github.com/analog-nico/hpp/issues"},"license":"ISC","author":{"name":"Nicolai Kamenzky","url":"https://github.com/analog-nico"},"main":"./lib/index.js","repository":{"type":"git","url":"git+https://github.com/analog-nico/hpp.git"},"scripts":{"test":"gulp ci"},"dependencies":{"lodash":"^4.7.0","type-is":"^1.6.12"},"engines":{"node":">=0.10.0"},"devDependencies":{"body-parser":"^1.15.0","chai":"^3.5.0","chalk":"^1.1.3","express":"^4.13.4","gulp":"^3.9.1","gulp-coveralls":"^0.1.4","gulp-istanbul":"^0.10.3","gulp-jshint":"^2.0.0","gulp-mocha":"^2.2.0","jshint":"^2.9.1","jshint-stylish":"^2.1.0","present":"0.0.6","request-promise":"^2.0.1","rimraf":"^2.5.2","run-sequence":"^1.1.5"},"gitHead":"b8dcef86c0cd52bc2f98e762b9a9554aec788600","_id":"hpp@0.2.2","_shasum":"0ec5f77472049a74361d85ba2b88e2470a4356f8","_from":".","_npmVersion":"2.15.11","_nodeVersion":"4.8.0","_npmUser":{"name":"analog-nico","email":"nicolai.kamenzky@testrails.org"},"maintainers":[{"name":"analog-nico","email":"nicolai.kamenzky@testrails.org"}],"dist":{"shasum":"0ec5f77472049a74361d85ba2b88e2470a4356f8","tarball":"https://registry.npmjs.org/hpp/-/hpp-0.2.2.tgz","integrity":"sha512-uGwv9D0+2L91evm6ihuOG2aJ3BIAUtJoH0KtNocd2Yv5tcooOyIt5ZXKnypBF8s1/e0O3VECfsfaRzGlRL9/Lw==","signatures":[{"keyid":"SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA","sig":"MEUCIBpF7yTDxumEueLPyTx1yW1O247YJRxnurMLbX9ftW3BAiEAmxj6QwM1+KjzlbseokSnHtZJztPFOW9ce6YKecYk4sc="}]},"_npmOperationalInternal":{"host":"packages-18-east.internal.npmjs.com","tmp":"tmp/hpp-0.2.2.tgz_1491957489151_0.8869520945008844"},"directories":{}},"0.2.3":{"name":"hpp","version":"0.2.3","description":"Express middleware to protect against HTTP Parameter Pollution attacks","keywords":["hpp","http","parameter","pollution","attack","security"],"homepage":"https://github.com/analog-nico/hpp","bugs":{"url":"https://github.com/analog-nico/hpp/issues"},"license":"ISC","author":{"name":"Nicolai Kamenzky","url":"https://github.com/analog-nico"},"main":"./lib/index.js","repository":{"type":"git","url":"git+https://github.com/analog-nico/hpp.git"},"scripts":{"test":"gulp ci"},"dependencies":{"lodash":"^4.17.12","type-is":"^1.6.12"},"engines":{"node":">=0.10.0"},"devDependencies":{"body-parser":"^1.15.0","chai":"^3.5.0","chalk":"^1.1.3","express":"^4.13.4","gulp":"^3.9.1","gulp-coveralls":"^0.1.4","gulp-istanbul":"^0.10.3","gulp-jshint":"^2.0.0","gulp-mocha":"^2.2.0","jshint":"^2.9.1","jshint-stylish":"^2.1.0","present":"0.0.6","request-promise":"^2.0.1","rimraf":"^2.5.2","run-sequence":"^1.1.5"},"gitHead":"cdf0babacc2ad8635a70376a19d66705b8ab62be","_id":"hpp@0.2.3","_shasum":"33bcc5fda713d2a962173c84f79a915a739b57bc","_from":".","_npmVersion":"3.10.10","_nodeVersion":"10.18.0","_npmUser":{"name":"analog-nico","email":"nicolai.kamenzky@testrails.org"},"maintainers":[{"name":"analog-nico","email":"nicolai.kamenzky@testrails.org"}],"dist":{"shasum":"33bcc5fda713d2a962173c84f79a915a739b57bc","tarball":"https://registry.npmjs.org/hpp/-/hpp-0.2.3.tgz","integrity":"sha512-4zDZypjQcxK/8pfFNR7jaON7zEUpXZxz4viyFmqjb3kWNWAHsLEUmWXcdn25c5l76ISvnD6hbOGO97cXUI3Ryw==","fileCount":5,"unpackedSize":13066,"npm-signature":"-----BEGIN PGP SIGNATURE-----\r\nVersion: OpenPGP.js v3.0.4\r\nComment: https://openpgpjs.org\r\n\r\nwsFcBAEBCAAQBQJeFNRPCRA9TVsSAnZWagAAbaoQAIeRulhF4DJlulgXEUpt\n8Sq/srapgTxCCaE02EklJhymOZ9IrlKEL/A4+eV0peiakFeDDmtxV4Vsvygw\n2ic8UQbZ6jBN898UZO/QzObJXRCdWGW8r9PtG5gmnIGAiQ+nYrxXRnbcf83Q\nXEaM69n4uednZhJfDdPA2lckT0fkg6L/boka19reMgi+gbNsCLXKxq4XQJ63\ng4iKel0a7LTFQ1+skdPyO4UfrVe1XTZ/ThP5ye1N5VVoZEhr2IccywKKEF53\n4PH+wxE88o1qxOse83CvRUmWNXHWivWhODCVHplGK1Rv/9iV+fR1F/qoXyQ4\n//H0r5g78SMZ3oDqZYP9mrQfShtwSkQRIz6h9GRmpeY0JLo3Jty5F8iVKBxH\nqfAhhwsIk3l5vdWCVHj/SpZ2M2MbeX/Xgx9YgsX44YBwx2L9PXDfLdXT9E4q\nhYuNYK01GSFw9EwgmmV/uCh1RKe046xP78uhu74Isu5AO8POxU7l5J1Iqtkz\nesXgV6nccjpcxzFL9ylE3pqZ5oPBwkozgwOWAbAFo3tyudLEaIRBkRodK1Ob\nRaaiepJlPEGtUCVyK5jcwQhhQIPlGOBURjwRaXdfQ3NH7sZu8tR0tkKCel/+\nZjkeLBAy7mzX5ZmSN513QkRKNWhXD4HjnOsCJ7EptMTJ1SvSuoJ9TtWyvIHq\nEZWZ\r\n=Ol7l\r\n-----END PGP SIGNATURE-----\r\n","signatures":[{"keyid":"SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA","sig":"MEQCIF0ZoMwT0dVAM2XimUe1+4Vr63vMBIHw/jhr0kpZLomxAiA1B0dOo5sYMM5QWotUMKINn473g9L0eE+BwuP5oLS9Lw=="}]},"directories":{},"_npmOperationalInternal":{"host":"s3://npm-registry-packages","tmp":"tmp/hpp_0.2.3_1578423374532_0.4808320187808992"},"_hasShrinkwrap":false}},"readme":"# HPP\n\n[Express](http://expressjs.com) middleware to **protect against HTTP Parameter Pollution attacks**\n\n[![Build Status](https://travis-ci.org/analog-nico/hpp.svg?branch=master)](https://travis-ci.org/analog-nico/hpp) [![Coverage Status](https://coveralls.io/repos/analog-nico/hpp/badge.png)](https://coveralls.io/r/analog-nico/hpp?branch=master) [![Dependency Status](https://david-dm.org/analog-nico/hpp.svg)](https://david-dm.org/analog-nico/hpp)\n\n## Why?\n\nLet [Chetan Karande's slides](https://speakerdeck.com/ckarande/top-overlooked-security-threats-to-node-dot-js-web-applications?slide=48) do the explaining:\n\n[![Slide 48](img/slide48.jpg)](https://speakerdeck.com/ckarande/top-overlooked-security-threats-to-node-dot-js-web-applications?slide=48)\n[![Slide 49](img/slide49.jpg)](https://speakerdeck.com/ckarande/top-overlooked-security-threats-to-node-dot-js-web-applications?slide=49)\n[![Slide 50](img/slide50.jpg)](https://speakerdeck.com/ckarande/top-overlooked-security-threats-to-node-dot-js-web-applications?slide=50)\n[![Slide 54](img/slide54.jpg)](https://speakerdeck.com/ckarande/top-overlooked-security-threats-to-node-dot-js-web-applications?slide=54)\n\n...and exploits may allow [bypassing the input validation](https://speakerdeck.com/ckarande/top-overlooked-security-threats-to-node-dot-js-web-applications?slide=57) or even result in [denial of service](https://speakerdeck.com/ckarande/top-overlooked-security-threats-to-node-dot-js-web-applications?slide=55).\n\n## And HPP solves this how exactly?\n\nHPP puts array parameters in `req.query` and/or `req.body` aside and just selects the last parameter value. You add the middleware and you are done.\n\n## Installation\n\n[![NPM Stats](https://nodei.co/npm/hpp.png?downloads=true)](https://npmjs.org/package/hpp)\n\nThis is a module for node.js and io.js and is installed via npm:\n\n``` bash\nnpm install hpp --save\n```\n\n## Getting Started\n\nAdd the HPP middleware like this:\n\n``` js\n// ...\nvar hpp = require('hpp');\n\n// ...\napp.use(bodyParser.urlencoded()); // Make sure the body is parsed beforehand.\n\napp.use(hpp()); // <- THIS IS THE NEW LINE\n\n// Add your own middlewares afterwards, e.g.:\napp.get('/search', function (req, res, next) { /* ... */ });\n// They are safe from HTTP Parameter Pollution now.\n```\n\n## Details about `req.query`\n\nBy default all top-level parameters in `req.query` are checked for being an array. If a parameter is an array the array is moved to `req.queryPolluted` and `req.query` is assigned the last value of the array:\n\n```\nGET /search?firstname=John&firstname=Alice&lastname=Doe\n\n=>\n\nreq: {\n    query: {\n        firstname: 'Alice',\n        lastname: 'Doe',\n    },\n    queryPolluted: {\n        firstname: [ 'John', 'Alice' ]\n    }\n}\n```\n\nChecking `req.query` may be turned off by using `app.use(hpp({ checkQuery: false }))`.\n\n## Details about `req.body`\n\n**Checking `req.body` is only done for requests with an urlencoded body. Not for json nor multipart bodies.**\n\nBy default all top-level parameters in `req.body` are checked for being an array. If a parameter is an array the array is moved to `req.bodyPolluted` and `req.body` is assigned the last value of the array:\n\n```\nPOST firstname=John&firstname=Alice&lastname=Doe\n\n=>\n\nreq: {\n    body: {\n        firstname: 'Alice',\n        lastname: 'Doe',\n    },\n    bodyPolluted: {\n        firstname: [ 'John', 'Alice' ]\n    }\n}\n```\n\nChecking `req.body` may be turned off by using `app.use(hpp({ checkBody: false }))`.\n\n## Whitelisting Specific Parameters\n\nThe `whitelist` option allows to specify parameters that shall not be touched by HPP. Usually specific parameters of a certain route are intentionally used as arrays. For that use the following approach that involves multiple HPP middlewares:\n\n``` js\n// Secure all routes at first.\n// You could add separate HPP middlewares to each route individually but the day will come when you forget to secure a new route.\napp.use(hpp());\n\n// Add a second HPP middleware to apply the whitelist only to this route.\napp.use('/search', hpp({ whitelist: [ 'filter' ] }));\n```\n\n```\nGET /search?package=Helmet&package=HPP&filter=nodejs&filter=iojs\n\n=>\n\nreq: {\n    query: {\n        package: 'HPP',\n        filter:  [ 'nodejs', 'iojs' ], // Still an array\n    },\n    queryPolluted: {\n        package: [ 'Helmet', 'HPP' ]\n    }\n}\n```\n\nThe whitelist works for both `req.query` and `req.body`.\n\n## Performance\n\nHPP was written with performance in mind since it eats CPU cycles for each request.\n\nA [performance test](test/spec/perf.js) that includes two HPP middlewares plus a whitelist simulates an already demanding use case. On my Mac Book Air it measures **0.002ms to process a single request**.\n\n## Contributing\n\nTo set up your development environment for HPP:\n\n1. Clone this repo to your desktop,\n2. in the shell `cd` to the main folder,\n3. hit `npm install`,\n4. hit `npm install gulp -g` if you haven't installed gulp globally yet, and\n5. run `gulp dev`. (Or run `node ./node_modules/.bin/gulp dev` if you don't want to install gulp globally.)\n\n`gulp dev` watches all source files and if you save some changes it will lint the code and execute all tests. The test coverage report can be viewed from `./coverage/lcov-report/index.html`.\n\nIf you want to debug a test you should use `gulp test-without-coverage` to run all tests without obscuring the code by the test coverage instrumentation.\n\n## Change History\n\n- v0.2.3 (2020-01-07)\n    - Updated lodash dependency because of vulnerability\n    - Added node v6, v8, v10 to CI build\n    - Removed node v5 from CI build\n- v0.2.2 (2017-04-11)\n    - Requiring individual lodash functions for faster boot time and lower memory footprint\n      *(Thanks to @mschipperheyn for suggesting this in [issue #6](https://github.com/analog-nico/hpp/issues/6))*\n- v0.2.1 (2016-04-03)\n    - Added node v4 and v5 to CI build\n    - Removed node v0.11 from CI build\n    - Updated dependencies\n- v0.2.0 (2015-05-25)\n    - Bumped version to 0.2 to properly follow semver since the whitelist was added in v0.1.2\n    - For better intuitiveness the last instead of the first value of an array is selected \n    - Refactoring to improve readability and performance\n      *(Thanks to @le0nik for [pull request #2](https://github.com/analog-nico/hpp/pull/2))*\n    - Updated dependencies\n      *(Thanks to @maxrimue for [pull request #3](https://github.com/analog-nico/hpp/pull/3))*\n- v0.1.2 (2015-05-18)\n    - Added [whitelist feature](#whitelisting-specific-parameters)\n      *(Thanks to @avaly for suggesting this in [issue #1](https://github.com/analog-nico/hpp/issues/1))*\n\t- Updated dependencies\n- v0.1.1 (2015-04-16)\n    - Removed two closures\n    - Updated lodash\n- v0.1.0 (2015-04-12)\n    - Updated dependencies\n    - Use in production satisfactory\n- v0.0.1 (2015-03-05)\n    - Initial version\n\n## License (ISC)\n\nIn case you never heard about the [ISC license](http://en.wikipedia.org/wiki/ISC_license) it is functionally equivalent to the MIT license.\n\nSee the [LICENSE file](LICENSE) for details.\n","maintainers":[{"name":"analog-nico","email":"nicolai.kamenzky@testrails.org"}],"time":{"modified":"2022-06-18T21:44:03.206Z","created":"2015-03-06T01:27:49.171Z","0.0.1":"2015-03-06T01:27:49.171Z","0.1.0":"2015-04-13T02:37:22.798Z","0.1.1":"2015-04-16T16:54:09.847Z","0.1.2":"2015-05-18T19:27:42.645Z","0.2.0":"2015-05-24T19:49:25.462Z","0.2.1":"2016-04-04T06:38:57.289Z","0.2.2":"2017-04-12T00:38:11.076Z","0.2.3":"2020-01-07T18:56:14.927Z"},"homepage":"https://github.com/analog-nico/hpp","keywords":["hpp","http","parameter","pollution","attack","security"],"repository":{"type":"git","url":"git+https://github.com/analog-nico/hpp.git"},"author":{"name":"Nicolai Kamenzky","url":"https://github.com/analog-nico"},"bugs":{"url":"https://github.com/analog-nico/hpp/issues"},"license":"ISC","readmeFilename":"README.md","users":{"itonyyo":true,"tarcio":true,"cilindrox":true,"gochomugo":true,"markthethomas":true,"grantcarthew":true,"dpjayasekara":true,"danielbankhead":true,"hckhanh":true,"esperluette":true,"tiggerhyun":true,"jmsherry":true,"shujianbu":true,"martinspinks":true,"ashish.npm":true}}