Weave Code
Filter Laravel Package
joomla/filter
Joomla's Filter package provides input and output sanitization utilities, letting you validate and clean user data and build URL-safe strings for secure PHP applications.
Joomla Framework Filter Package
Frequently asked questions about Filter
- What does the Joomla Filter package do in a Laravel application?
- The Joomla Filter package provides input and output sanitization utilities for PHP applications, including configurable HTML tag and attribute whitelisting or blacklisting and methods such as OutputFilter::stringURLSafe for URL-safe strings. In Laravel it largely overlaps with built-in validation, Blade escaping, and dedicated HTML purifiers, so it is only a good fit when you specifically need Joomla-style filtering rules. It is not a Laravel-native validation or middleware layer.
- How do I install joomla/filter in Laravel with Composer?
- Install it with Composer, for example composer require joomla/filter ~4.0 for PHP 8.3+ projects or ~3.0 for PHP 8.1/8.2 Laravel 9/10 applications. There is no Laravel service provider or config file to publish; the package classes are autoloaded directly. Check your PHP version first because the major versions have different PHP minimums.
- Is joomla/filter compatible with Laravel 10 and Laravel 11?
- There is no official Laravel integration, so compatibility depends mainly on PHP version and your own testing. The 3.x line requires PHP 8.1+ and can work on Laravel 9 and 10, while 4.x requires PHP 8.3+ and suits newer Laravel stacks. The package has no Laravel-specific tests, so verify double-escaping and validation pipeline behavior in your app.
- Is joomla/filter safe for XSS protection after the 3.0.7 release?
- Version 3.0.7 fixed two XSS filter bypasses: whitespace-obfuscated data: URIs and an HTML5 entity-decoding mismatch between the filter and downstream parser. Versions 3.0.6 and earlier are exploitable if user-supplied HTML or URI-bearing attributes reach storage or output. Because this is a hand-rolled regex and parse-based sanitizer, treat it as structurally fragile and assume further bypass classes may exist. For general HTML purification, a parser-based library like HTMLPurifier is usually safer.
- What are Laravel-native alternatives to joomla/filter?
- Laravel developers typically use Blade auto-escaping and the e() helper for output encoding, Laravel validation rules such as Sanitize, and a parser-based HTML purifier like htmlpurifier/htmlpurifier for rich text. Those cover most sanitization needs without adding a Joomla dependency. The Joomla package is justified mainly when you need Joomla-specific behavior such as OutputFilter::stringURLSafe.
- Why does joomla/filter require the Joomla Language package?
- The Joomla Language package is an optional dependency and is only required when your application uses OutputFilter::stringURLSafe. If you do not need Joomla-style URL-safe transliteration, you can avoid that coupling in a Laravel app. Pulling it in otherwise adds a Joomla component dependency you probably do not need.
- How do I whitelist HTML tags and attributes with joomla/filter?
- The package supports configurable tag and attribute whitelists and blacklists, so you can allow tags such as b and i while blocking script. In 3.x the constants were renamed, for example TAGS_WHITELIST became ONLY_ALLOW_DEFINED_TAGS, so confirm the API for your installed version. Test encoded payloads, mutation XSS cases, and URI attributes carefully because bypasses have been found in this filtering model.
- Does joomla/filter conflict with Blade escaping or cause double encoding?
- Yes, there is a real double-encoding risk when you combine Joomla Filter output sanitization with Blade auto-escaping or the e() helper. Laravel already escapes rendered output, so running another HTML filter at the output boundary can change entities and break expected content. Use the package at the input or storage boundary, or only for specific URL-safe operations, and test rendered HTML end to end.
- Should I upgrade from joomla/filter 3.0.6 to 3.0.7 in production?
- Yes. If any service is pinned to joomla/filter 3.0.6 or earlier and user-supplied HTML or URI-bearing attributes can reach storage or output, upgrade to 3.0.7 promptly. The release is patch-level with no API change, so remediation cost is low, but confirm the advisory status and run composer audit because the release notes cited no CVE or GHSA identifiers. Also scan composer.lock files for the vulnerable version.
- Is joomla/filter actively maintained and widely adopted for Laravel projects?
- The assessment reports low adoption, around 15 stars and 0 dependents, which raises stagnation risk and means fewer community eyes may find bypasses. The package has no Laravel integration or Laravel-specific tests. For a typical Laravel application, prefer a maintained Laravel-native sanitizer unless Joomla-specific filtering rules are a hard requirement.
Weaver
How can I help you explore Laravel packages today?