TURBO for Developers

Home > widget-integration > FilterValidationHelper

FilterValidationHelper class

Validation Helper for Filter Module

Provides comprehensive validation and sanitization utilities for the filter system, including XSS detection, input validation, and data sanitization for secure filter operations.

This helper can be extended by Technical Support teams to customize validation rules for specific shops, including custom XSS patterns, allowed characters, or sanitization behavior.

Signature:

export declare class FilterValidationHelper

Remarks

Security Approach: - XSS detection uses pattern matching for common attack vectors (script tags, event handlers, JavaScript) - Sanitization blocks malicious content rather than attempting to fix it - All HTML is treated as potentially dangerous unless explicitly validated - DOM events list includes 100+ event handlers for comprehensive XSS prevention

Performance Optimizations: - DOM events array is cached as static constant - Regex patterns are compiled once and reused - Validation methods are stateless for parallel execution

Example 1

Extend to customize XSS detection:

window.boostWidgetIntegration.extend('FilterValidationHelper', (FilterValidationHelper) => {
  return class CustomValidationHelper extends FilterValidationHelper {
    isBadSearchTerm(term) {
      // Add shop-specific blocked terms
      if (typeof term === 'string' && term.includes('shop-blocked-word')) {
        return true;
      }
      return super.isBadSearchTerm(term);
    }
  };
});

Example 2

Override to customize allowed characters:

window.boostWidgetIntegration.extend('FilterValidationHelper', (FilterValidationHelper) => {
  return class extends FilterValidationHelper {
    isAlphanumeric(value, allowedChars) {
      // Allow additional characters for Asian market shops
      const customChars = allowedChars + '。、';
      return super.isAlphanumeric(value, customChars);
    }
  };
});

Example 3

Add custom validation logging:

window.boostWidgetIntegration.extend('FilterValidationHelper', (FilterValidationHelper) => {
  return class extends FilterValidationHelper {
    sanitizeFilterLabel(label) {
      const result = super.sanitizeFilterLabel(label);
      if (result === '[Blocked Content]') {
        console.warn('Blocked malicious filter label:', label);
      }
      return result;
    }
  };
});

Methods

Method	Modifiers	Description
escapeHtml(text)		Escapes special characters in a string for safe use in HTML. Converts characters like <, >, &, ", ' to their HTML entity equivalents.
hasUniqueValues(array)		Validates if an array contains only unique values. Uses Set comparison to detect duplicates efficiently.
isAlphanumeric(value, allowedChars)		Validates if a string contains only alphanumeric characters and allowed special chars. Useful for validating filter keys, handles, product IDs, and other identifiers. Override to support additional character sets for international shops.
isBadSearchTerm(term)		Checks if a search term contains potentially malicious content. Detects XSS patterns, JavaScript code, HTML tags, and event handlers using multi-layered pattern matching for comprehensive security.
isEmpty(value)		Validates if a string is empty or only contains whitespace. Handles multiple types: null/undefined, strings, arrays, and objects. Strings are considered empty if they contain only whitespace.
isInRange(value, min, max)		Validates if a value is within a specified range. Performs inclusive range checking (min <= value <= max).
isInteger(value)		Validates if a value is a valid integer. Accepts both number types and numeric strings. Rejects decimals.
isPositiveNumber(value)		Validates if a value is a valid positive number. Checks if the value is a valid number and greater than zero.
isValidColor(color)		Validates if a color string is valid (hex, rgb, rgba, or named color). Supports multiple color formats: - Hex: #fff, #ffffff, #ffffffff - RGB/RGBA: rgb(255, 0, 0), rgba(255, 0, 0, 0.5) - Named colors: red, blue, transparent, etc.
isValidEmail(email)		Validates if a string is a valid email address. Uses basic email format validation (local@domain.tld).
isValidJson(value)		Validates if a value is a valid JSON string. Attempts to parse the string as JSON to verify validity.
isValidLength(value, minLength, maxLength)		Validates if a string length is within acceptable bounds. Checks if string length falls between minimum and maximum values (inclusive).
isValidNumber(value)		Validates if a value is a valid number. Checks both number types and numeric strings, rejecting NaN and Infinity.
isValidUrl(url)		Validates if a string is a valid URL. Uses the URL constructor for validation, which checks protocol, host, and format.
matchesPattern(value, pattern)		Validates if a string matches a specific pattern. Uses custom regex pattern for flexible validation rules.
normalizeWhitespace(value)		Trims and normalizes whitespace in a string. Removes leading/trailing whitespace and replaces multiple spaces with single space.
sanitizeFilterLabel(label)		Sanitizes a filter label by removing or blocking malicious content. Returns a safe string that can be displayed in the UI. Uses strict blocking approach - malicious content is replaced with placeholder rather than sanitized.
sanitizeUrlParam(value)		Sanitizes a value for use as a URL parameter. Removes or encodes potentially problematic characters using encodeURIComponent.
slugify(text)		Converts a string to a URL-friendly slug. Transforms text into a format suitable for URLs by: - Converting to lowercase - Replacing spaces with hyphens - Removing special characters - Collapsing multiple hyphens
stripHtml(html)		Sanitizes a string by removing all HTML tags. Strips all HTML markup, leaving only text content. Useful for displaying user-generated content safely.

← Back to Library Reference