Filament

https://filamentphp.com/docs
Admin
Filament is a Server-Driven UI framework for Laravel that enables developers to build admin panels,...
Tokens:3,712
Snippets:68
Trust Score:9.6
Update:4 months ago
Show doc for...
Tokens:
Raw
### Replace Sanitizer Configuration Entirely

Source: https://filamentphp.com/docs/advanced/security

Completely rebind the HtmlSanitizerConfig in a service provider to gain full control over the sanitization rules, for example, by removing certain attributes and setting a max input length.

```php
use Symfony\Component\HtmlSanitizer\HtmlSanitizerConfig;

public function register(): void
{
    $this->app->scoped(
        HtmlSanitizerConfig::class,
        fn (): HtmlSanitizerConfig => (new HtmlSanitizerConfig)
            ->allowSafeElements()
            ->allowRelativeLinks()
            ->allowRelativeMedias()
            ->allowAttribute('class', allowedElements: '*')
            ->withMaxInputLength(500000),
    );
}

```

--------------------------------

### Allow Custom URL Schemes with `Str::sanitizeUrl()`

Source: https://filamentphp.com/docs/advanced/security

Extend the allowed URL schemes beyond the default 'http' and 'https' by passing a custom array to `Str::sanitizeUrl()`. This is useful for schemes like 'mailto:' or 'tel:'.

```php
TextColumn::make('contact')
    ->url(fn (string $state): ?string => Str::sanitizeUrl(
        $state,
        allowedSchemes: ['http', 'https', 'mailto', 'tel'],
    ))
```

--------------------------------

### Custom Domain Whitelisting for URLs

Source: https://filamentphp.com/docs/advanced/security

Implement a stricter URL validation by wrapping `Str::sanitizeUrl()` with your own logic to check if the sanitized URL's host belongs to a specific domain. This adds an extra layer of security against open-redirect vulnerabilities.

```php
TextColumn::make('website')
    ->url(function (string $state): ?string {
        $sanitized = Str::sanitizeUrl($state);

        if (blank($sanitized)) {
            return null;
        }

        $host = parse_url($sanitized, PHP_URL_HOST);

        return in_array($host, ['example.com', 'cdn.example.com'], true)
            ? $sanitized
            : null;
    })
```

--------------------------------

### Default Sanitizer Configuration

Source: https://filamentphp.com/docs/advanced/security

This is the default configuration for Filament's HTML sanitizer, allowing safe elements and specific attributes while setting a maximum input length.

```php
use Symfony\Component\HtmlSanitizer\HtmlSanitizerConfig;

(new HtmlSanitizerConfig)
    ->allowSafeElements()
    ->allowRelativeLinks()
    ->allowRelativeMedias()
    ->allowAttribute('class', allowedElements: '*')
    ->allowAttribute('data-color', allowedElements: '*')
    ->allowAttribute('data-cols', allowedElements: '*')
    ->allowAttribute('data-col-span', allowedElements: '*')
    ->allowAttribute('data-from-breakpoint', allowedElements: '*')
    ->allowAttribute('data-id', allowedElements: '*')
    ->allowAttribute('data-type', allowedElements: '*')
    ->allowAttribute('style', allowedElements: '*')
    ->allowAttribute('width', allowedElements: 'img')
    ->allowAttribute('height', allowedElements: 'img')
    ->withMaxInputLength(500000)

```

--------------------------------

### Extend Default Sanitizer to Allow Custom Attributes

Source: https://filamentphp.com/docs/advanced/security

Extend the default HtmlSanitizerConfig in a service provider to permit additional attributes, such as 'data-custom'.

```php
use Symfony\Component\HtmlSanitizer\HtmlSanitizerConfig;

public function register(): void
{
    $this->app->extend(
        HtmlSanitizerConfig::class,
        fn (HtmlSanitizerConfig $config): HtmlSanitizerConfig => $config
            ->allowAttribute('data-custom', allowedElements: '*'),
    );
}

```

--------------------------------

### Sanitize URLs in Filament Columns

Source: https://filamentphp.com/docs/advanced/security

Use `Str::sanitizeUrl()` to safely render URLs from user input in Filament table columns. This prevents XSS by ensuring only safe URL schemes are allowed.

```php
use Filament\Tables\Columns\TextColumn;
use Illuminate\Support\Str;

TextColumn::make('website')
    ->url(fn (string $state): ?string => Str::sanitizeUrl($state))
```

--------------------------------

### Restrict File Uploads to Schema Components in Livewire

Source: https://filamentphp.com/docs/advanced/security

Use the `RestrictsFileUploadsToSchemaComponents` trait to prevent arbitrary file uploads to Livewire properties. This ensures uploads are only accepted for properties corresponding to registered schema components like FileUpload or RichEditor.

```php
use Filament\Schemas\Concerns\InteractsWithSchemas;
use Filament\Schemas\Concerns\RestrictsFileUploadsToSchemaComponents;
use Filament\Schemas\Contracts\HasSchemas;
use Livewire\Component;

class ViewProduct extends Component implements HasSchemas
{
    use InteractsWithSchemas;
    use RestrictsFileUploadsToSchemaComponents;

    // ...
}
```

--------------------------------

### Extend Default Sanitizer to Drop Attributes

Source: https://filamentphp.com/docs/advanced/security

Modify the default HtmlSanitizerConfig by dropping specific attributes, like 'style', to enhance security, but be aware of potential impacts on rich text features.

```php
use Symfony\Component\HtmlSanitizer\HtmlSanitizerConfig;

public function register(): void
{
    $this->app->extend(
        HtmlSanitizerConfig::class,
        fn (HtmlSanitizerConfig $config): HtmlSanitizerConfig => $config
            ->dropAttribute('style', '*'),
    );
}

```

--------------------------------

### Sanitize Markdown Content in Blade Views

Source: https://filamentphp.com/docs/advanced/security

Chain `markdown()` and `sanitizeHtml()` helpers to safely render Markdown content as HTML in Blade views, preventing XSS vulnerabilities.

```php
{!! str($record->content)->markdown()->sanitizeHtml() !!}

```

--------------------------------

### Sanitize HTML Content in Blade Views

Source: https://filamentphp.com/docs/advanced/security

Use the `sanitizeHtml()` string helper in Blade views to sanitize HTML content, especially when it originates from user input or rich text editors.

```php
{!! str($record->content)->sanitizeHtml() !!}

```
Tokens:
Raw