Filter Laravel Package

Product Decisions This Supports

• Security Compliance: Addresses OWASP Top 10 (A03:2021 Injection) and GDPR/PCI-DSS requirements for sanitizing user-generated HTML content (e.g., comments, forums, CMS posts) with configurable whitelisting/blacklisting of tags/attributes.
• Roadmap Efficiency: Accelerates development of rich-text input features (e.g., Markdown-to-HTML, WYSIWYG editors) by providing pre-built XSS protection, reducing reliance on custom regex or ad-hoc strip_tags().
• Build vs. Buy: Avoids reinventing security-critical filtering logic, leveraging Joomla’s battle-tested (though PHP-centric) solution instead of maintaining custom sanitization. Ideal for teams prioritizing security over customization.
• Use Cases:
  • Public-facing forms (contact, surveys) requiring HTML input with strict sanitization.
  • Laravel-based CMS/plugins (e.g., Nova, Forge) needing granular control over allowed HTML elements.
  • Legacy system migrations where Joomla’s filtering logic must be reused in Laravel.
  • Community-driven platforms (e.g., Q&A, wikis) where user-generated content risks XSS.

When to Consider This Package

• Adopt if:

  • Your Laravel app processes HTML input (e.g., WYSIWYG editors, user avatars) and requires configurable XSS protection beyond Laravel’s e() or strip_tags().
  • You need tag/attribute whitelisting (e.g., allow <b>, <i>, but block <script>) without managing a custom solution.
  • Your team lacks expertise in HTML sanitization libraries (e.g., HTMLPurifier) and prefers a lightweight, PHP-native approach.
  • You’re already using Joomla components or need interoperability with Joomla’s ecosystem.
  • You prioritize security over performance and can tolerate minor overhead.

• Look elsewhere if:

  • Your stack uses non-PHP (e.g., Node.js, Python) or relies on Laravel’s native validation (e.g., Illuminate\Validation\Rules\Sanitize) for simple inputs.
  • You require advanced features like DOM parsing (use HTMLPurifier or DOMDocument), real-time filtering (WebSockets), or JavaScript integration.
  • Your PHP version is <8.1 (package drops support for older versions) or you need active maintenance (low stars/dependents signal risk).
  • You prioritize performance-critical paths (this package adds overhead vs. native PHP functions or Laravel’s built-in escaping).
  • You’re building a new Laravel project with no Joomla legacy dependencies (Laravel’s native tools may suffice).

How to Pitch It (Stakeholders)

For Executives: "This package lets us deploy secure, configurable HTML sanitization in Laravel without building or maintaining custom XSS protection. It’s a drop-in solution for high-risk inputs like user comments or CMS content, reducing vulnerabilities while cutting development time. Joomla’s track record in security—despite low stars—makes it a pragmatic choice for core features. The tradeoff? Minimal maintenance risk vs. zero active development, but the security upside outweighs that for critical user inputs."

For Engineering: *"The joomla/filter package provides battle-tested HTML sanitization for Laravel, with key benefits:

• Out-of-the-box XSS protection: Handles edge cases like XSS evasion characters (since v2.0.6+) and nested tags.
• Configurable whitelists/blacklists: Define allowed tags/attributes via constructor or static methods (e.g., block <script> but allow <a href>).
• Lightweight: ~50KB, no heavy dependencies (unlike HTMLPurifier).
• Laravel-friendly: Works with Composer and can be wrapped in service providers for DI.

Caveats:

• Not Laravel-native: Requires manual integration (e.g., wrapping in a helper class).
• Maintenance risk: Low stars/dependents mean we’d need to monitor updates closely (e.g., CVE-2022-23800 was patched but affects older versions).
• PHP 8.1+ only: Blocks use in legacy systems.

Recommendation: Use for critical HTML inputs (e.g., comments, posts) where XSS is a priority, but combine with Laravel’s validation layer for non-HTML fields. Avoid for high-traffic APIs where performance is critical. Alternative: If Joomla-specific features aren’t needed, consider Laravel’s built-in escaping (e()) or HTMLPurifier for advanced use cases."*

For Security Teams: *"This package mitigates A03:2021 Injection (XSS) by providing:

• Configurable HTML sanitization: Whitelist/blacklist tags/attributes to block unsafe elements (e.g., <script>, javascript: URIs).
• XSS evasion mitigation: Strips payloads like ', data: URIs, and common evasion characters (since v4.0.1).
• Compliance alignment: Reduces attack surface for user-generated content, supporting GDPR (data integrity) and PCI-DSS (input validation).

Mitigations for risks:

• Pin to a specific version (e.g., ~4.0) to avoid breaking changes.
• Combine with Laravel’s e() for output escaping and CSRF tokens for forms.
• Test with OWASP XSS Filter Evasion Cheat Sheet to validate protection.
• Monitor updates: Low activity means manual review of security patches (e.g., CVE-2022-23800)."*