ArtisanPack UI Security

The core Laravel security toolkit in the ArtisanPack UI ecosystem. Focused on input sanitization, output escaping, KSES filtering, security headers, XSS protection, basic rate limiting, and Content Security Policy.

Security 2.0 — core-only. Authentication, 2FA, RBAC, file uploads, analytics, and compliance have moved to dedicated sibling packages. See UPGRADE.md for migrating from 1.x.

What's in this package

• Sanitization — sanitizeEmail, sanitizeUrl, sanitizeText, sanitizeInt, sanitizeArray, …
• Escaping — escHtml, escAttr, escUrl, escJs, escCss (Laminas Escaper backed)
• KSES filtering — kses() WordPress-style allowed-tag filtering
• Validation rules — NoHtml, SecureUrl
• Middleware — csp, security.headers, xss.protection, api.security, api.rate_limit
• Content Security Policy — nonce generator, policy builder, presets, violation reporting endpoint, CSP dashboard Livewire component (optional — requires livewire/livewire), Artisan commands (csp:test, csp:stats, csp:prune, security:generate-csp)
• Security audit commands — security:audit, security:scan, security:baseline, security:benchmark, security:check-config, security:test-headers, security:scan-deps
• Testing infrastructure — OWASP scanner, configuration scanner, penetration testing helpers, performance benchmarks, report generators

What's NOT in this package (sibling packages)

Installation

composer require artisanpack-ui/security

Publish the config:

php artisan vendor:publish --tag=security-config

Quick Start

use ArtisanPackUI\Security\Facades\Security;

$cleanEmail = Security::sanitizeEmail($userEmail);
echo Security::escHtml($userContent);

Or use the global helpers:

$cleanEmail = sanitizeEmail($userEmail);
echo escHtml($userContent);

Middleware

Route::middleware(['csp', 'security.headers', 'xss.protection'])->group(function () {
    // ...
});

Route::middleware('api.rate_limit:api')->group(function () {
    // ...
});

CSP nonces in Blade

<script @csp_nonce>
    // ...
</script>

Hooks

The package fires a small set of artisanpack-ui/hooks filters and actions so host apps can extend sanitization, escaping, KSES, and CSP handling without subclassing. Register subscribers with addFilter() / addAction().

Security note. ap.security.sanitizedInput and ap.security.escapedOutput subscribers receive the already sanitized/escaped value and can return anything — including the untouched original — which effectively lets them weaken the guarantees this package provides. Only register callbacks you fully trust, and prefer narrowing (further sanitization) over broadening. The same applies to ap.security.ksesAllowedTags: a subscriber that returns a permissive tag list expands the attack surface of every kses() call in the app.

Example:

// Force every escaped URL through your own allowlist before it's emitted.
addFilter( 'ap.security.escapedOutput', function ( string $value, string $context, string $original ): string {
    if ( $context !== 'url' ) {
        return $value;
    }

    return app( UrlAllowlist::class )->passes( $original ) ? $value : '#blocked';
} );

// Ship every stored CSP violation into your own alerting queue.
addAction( 'ap.security.csp.violationHandled', function ( CspViolationReport $report ): void {
    SecurityAlerts::dispatch( $report );
} );

Documentation

• Getting Started
• API Reference
• Security Guidelines
• Upgrading from 1.x → 2.0
• Changelog

Requirements

• PHP 8.2+
• Laravel 10 / 11 / 12 / 13 (Laravel 13 requires PHP 8.3+)

Sibling packages

License

MIT — see LICENSE.