Laravel HTML Sanitizer

https://github.com/jeffersongoncalves/laravel-html-sanitizer
Admin
Laravel HTML Sanitizer is a Laravel package that wraps the Symfony HTML Sanitizer to safely clean...
Tokens:3,372
Snippets:31
Trust Score:9.8
License:MIT
Update:1 month ago
Show doc for...
Tokens:
Raw
### Install Laravel HTML Sanitizer

Source: https://github.com/jeffersongoncalves/laravel-html-sanitizer/blob/master/README.md

Install the package via Composer.

```bash
composer require jeffersongoncalves/laravel-html-sanitizer
```

--------------------------------

### Install and publish config for laravel-html-sanitizer

Source: https://github.com/jeffersongoncalves/laravel-html-sanitizer/blob/master/resources/boost/skills/html-sanitizer-development/SKILL.md

Install the package with Composer. Publish the config file only when you need to adjust the allowlist; the package ships with safe defaults.

```bash
composer require jeffersongoncalves/laravel-html-sanitizer
```

```bash
php artisan vendor:publish --tag="html-sanitizer-config"
```

--------------------------------

### Sanitize HTML with HtmlSanitizer::clean()

Source: https://github.com/jeffersongoncalves/laravel-html-sanitizer/blob/master/README.md

Sanitize untrusted HTML by passing it through HtmlSanitizer::clean(). The example shows a dirty string with a script and an onerror attribute, and the resulting clean output.

```php
use JeffersonGoncalves\HtmlSanitizer\HtmlSanitizer;

$dirty = '<p>Hello</p><script>alert("xss")</script><img src="x" onerror="steal()">';

$clean = HtmlSanitizer::clean($dirty);
// <p>Hello</p><img src="x">
```

--------------------------------

### Run tests, static analysis, and formatting

Source: https://github.com/jeffersongoncalves/laravel-html-sanitizer/blob/master/resources/boost/skills/html-sanitizer-development/SKILL.md

Run the test suite, static analysis, and code formatting for the project. Use `vendor/bin/pest` for tests, `--coverage` for coverage, `vendor/bin/phpstan analyse` for static analysis, and `vendor/bin/pint` for formatting.

```bash
# Run all tests
vendor/bin/pest

# Run with coverage
vendor/bin/pest --coverage

# Static analysis
vendor/bin/phpstan analyse

# Code formatting
vendor/bin/pint
```

--------------------------------

### Configure HtmlSanitizerConfig with default allowlist

Source: https://github.com/jeffersongoncalves/laravel-html-sanitizer/blob/master/resources/boost/skills/html-sanitizer-development/SKILL.md

Build the default sanitizer configuration. allowSafeElements() enables the curated presentational set; class/id are kept on every element; width/height are scoped to <img>; data is deliberately excluded from media schemes because a data:image/svg+xml URI can carry executable script. max_input_length defaults to ~2 MB to bound work on a hostile payload; set -1 to disable the cap. Everything not allowed — <script>, <style>, event-handler attributes (onerror, onclick), Alpine x-* attributes, unsafe schemes — is removed.

```php
(new HtmlSanitizerConfig)
    ->allowSafeElements()
    ->allowRelativeLinks()       // config: allow_relative_links (default true)
    ->allowRelativeMedias()      // config: allow_relative_medias (default true)
    ->allowLinkSchemes(['https', 'http', 'mailto'])   // config: link_schemes
    ->allowMediaSchemes(['https', 'http'])            // config: media_schemes — NO 'data'
    ->withMaxInputLength(2_000_000)                   // config: max_input_length (~2 MB cap)
    ->allowAttribute('class', '*')
    ->allowAttribute('id', '*')
    ->allowAttribute('width', ['img'])
    ->allowAttribute('height', ['img']);
```

--------------------------------

### Run tests with composer test

Source: https://github.com/jeffersongoncalves/laravel-html-sanitizer/blob/master/README.md

Run the package test suite.

```bash
composer test
```

--------------------------------

### Publish html-sanitizer-config

Source: https://github.com/jeffersongoncalves/laravel-html-sanitizer/blob/master/README.md

Publish the package configuration file to customize allowed schemes, attributes, and maximum input length.

```bash
php artisan vendor:publish --tag="html-sanitizer-config"
```

--------------------------------

### Allow attribute on specific elements and add link scheme in config/html-sanitizer.php

Source: https://github.com/jeffersongoncalves/laravel-html-sanitizer/blob/master/resources/boost/skills/html-sanitizer-development/SKILL.md

Edit the published config file to allow an attribute on specific elements and add an additional link scheme. Keep attribute additions scoped to specific elements. Never add 'data' to 'media_schemes' due to XSS risk. Add tests for kept and stripped cases.

```php
// Allow an attribute on specific elements only (preferred — keep it scoped)
'attributes' => [
    // ...defaults...
    'data-foo' => ['div', 'span'],
],

// Allow an additional link scheme
'link_schemes' => ['https', 'http', 'mailto', 'tel'],
```

--------------------------------

### Default html-sanitizer config

Source: https://github.com/jeffersongoncalves/laravel-html-sanitizer/blob/master/README.md

Default configuration returned by the published config file. Sets max_input_length to -1 (unlimited), allows relative links and medias, restricts link schemes to https/http/mailto, media schemes to https/http (excluding data), and preserves class/id on all elements plus width/height on img.

```php
return [
    // -1 = unlimited. Symfony otherwise truncates input at 20000 bytes,
    // silently cutting long READMEs/articles mid-content.
    'max_input_length' => -1,

    'allow_relative_links' => true,
    'allow_relative_medias' => true,

    'link_schemes' => ['https', 'http', 'mailto'],

    // 'data' is intentionally omitted: data:image/svg+xml can carry script.
    'media_schemes' => ['https', 'http'],

    'attributes' => [
        'class' => '*',
        'id' => '*',
        'width' => ['img'],
        'height' => ['img'],
    ],
];
```

--------------------------------

### Sanitize HTML with HtmlSanitizer::clean()

Source: https://github.com/jeffersongoncalves/laravel-html-sanitizer/blob/master/resources/boost/skills/html-sanitizer-development/SKILL.md

Use the static clean() API to sanitize untrusted HTML. It builds a Symfony HtmlSanitizer from a HtmlSanitizerConfig and runs ->sanitize(). The sanitizer is memoised per config signature and rebuilds automatically when any config value changes; call HtmlSanitizer::flush() to force a rebuild.

```php
use JeffersonGoncalves\HtmlSanitizer\HtmlSanitizer;

$clean = HtmlSanitizer::clean($untrustedHtml);
```

--------------------------------

### Assert stripped content with HtmlSanitizer::clean

Source: https://github.com/jeffersongoncalves/laravel-html-sanitizer/blob/master/resources/boost/skills/html-sanitizer-development/SKILL.md

Use these Pest tests to verify that the sanitizer removes script tags, inline event handlers, and Alpine.js attributes. The tests assert that the cleaned output does not contain the dangerous patterns.

```php
use JeffersonGoncalves\HtmlSanitizer\HtmlSanitizer;

it('strips script tags', function () {
    $clean = HtmlSanitizer::clean('<p>Hi</p><script>alert(1)</script>');

    expect($clean)
        ->not->toContain('<script')
        ->toContain('<p>Hi</p>');
});

it('strips event handlers', function () {
    expect(HtmlSanitizer::clean('<img src="x" onerror="x()">'))
        ->not->toContain('onerror');
});

it('strips alpine attributes', function () {
    expect(HtmlSanitizer::clean('<div x-data="{}">Menu</div>'))
        ->not->toContain('x-data');
});
```

--------------------------------

### Assert kept content with HtmlSanitizer::clean

Source: https://github.com/jeffersongoncalves/laravel-html-sanitizer/blob/master/resources/boost/skills/html-sanitizer-development/SKILL.md

Use this Pest test to verify that the sanitizer preserves safe HTML elements and attributes such as tables, links, image sizing, and class attributes. It asserts that the cleaned output contains the expected safe content.

```php
it('keeps tables, links and image sizing', function () {
    expect(HtmlSanitizer::clean('<table><tr><td>1</td></tr></table>'))->toContain('<td>1</td>');
    expect(HtmlSanitizer::clean('<a href="https://example.com">L</a>'))->toContain('href="https://example.com"');
    expect(HtmlSanitizer::clean('<img src="https://e.com/a.png" width="20%">'))->toContain('width="20%"');
    expect(HtmlSanitizer::clean('<p class="lead" id="x">Hi</p>'))->toContain('class="lead"');
});
```
Tokens:
Raw