Filter Laravel Package

Getting Started

Install the package via Composer: composer require joomla/filter "~3.0" (or ~4.0 for PHP 8.3+). Start with the Joomla\Filter\InputFilter class for sanitizing user input—especially HTML content—before storage or output. The primary use case is preventing XSS attacks by filtering HTML strings, e.g., InputFilter::clean($html, 'html'). For simple scalar values (strings, integers), use InputFilter::clean($value, 'cmd') or 'int'. Check the InputFilter::TAGS_WHITELIST → ONLY_ALLOW_DEFINED_TAGS and ATTR_BLACKLIST → ONLY_BLOCK_DEFINED_ATTRIBUTES constant renamings if upgrading from v1.

Implementation Patterns

• HTML sanitization: Use InputFilter::clean($input, 'html') with default tag/attribute filtering; customize via blockedTags, blockedAttributes, allowedTags, allowedAttributes arrays in the constructor or via static setters.
• Custom filtering: Extend Joomla\Filter\InputFilter to create domain-specific filters (e.g., PostFilter extends InputFilter) and override filter() or implement preFilter()/postFilter() hooks.
• Security-first defaults: When filtering user-submitted content (e.g., comments), use strict modes:

  $filter = new InputFilter([], [], InputFilter::ONLY_ALLOW_DEFINED_TAGS, InputFilter::ONLY_BLOCK_DEFINED_ATTRIBUTES, true); // $xssAuto = true
  

• Integration with Laravel: Wrap InputFilter in a service provider or helper (e.g., filter_html($html)) and register it for injection. For request validation, call InputFilter::clean() in custom validation rules.
• String safety: Use OutputFilter::stringURLSafe($string) for generating SEO-friendly slugs (requires joomla/language optionally, for multibyte support).

Gotchas and Tips

• XSS evasion characters: Versions ≥2.0.6, ≥3.0.5, and ≥4.0.1 now strip common XSS tricks (e.g., javascript:, ', &#0000106). Always upgrade to patch releases—critical vulnerabilities were found in earlier versions (CVE-2022-23800).
• Case insensitivity & recursion: Bug fixes in stripImages/stripIframes (v3.0.2+) handle <img style="..."/> and nested tags correctly. Use grep to verify your version if filtering HTML5 media.
• Multibyte gotchas: In earlier versions, mbstring functions were used inconsistently; newer versions default to non-multibyte methods. For multibyte input (e.g., non-Latin slugs), ensure OutputFilter::stringURLSafe() is used with joomla/language installed.
• Configuration quirk: The static InputFilter class maintains global state; avoid it in long-running processes (e.g., Swoole). Instantiate per-request instead: (new InputFilter($blockedTags, $blockedAttrs, ...)).
• Extension point: Override getClean() to add custom filter types (e.g., 'markdown', 'bbcode') by registering them in your child class’s filter() method.
• Testing tip: Validate your filter rules with known XSS payloads (e.g., <img src=x onerror=alert(1)>) using PHPUnit—preferably in integration tests to catch regressions after version bumps.