Filter Laravel Package

Product Decisions This Supports

• Security hardening: Mitigates XSS risks in user-generated content (e.g., comments, CMS posts, forums) by providing configurable HTML sanitization, aligning with OWASP Top 10 and compliance requirements (GDPR, PCI-DSS).
• Roadmap acceleration: Enables rapid implementation of input validation pipelines for Laravel applications handling untrusted HTML, reducing time-to-market for features like rich-text editors or community-driven content.
• Build vs. buy: Avoids reinventing security-critical filtering logic, leveraging Joomla’s battle-tested (though PHP-centric) solution instead of custom regex or ad-hoc strip_tags() usage. Ideal for teams prioritizing security over customization.
• Use cases:
  • Public-facing forms (contact, surveys) requiring HTML input.
  • CMS plugins or Laravel-based content platforms (e.g., Nova, Forge) needing granular tag/attribute control.
  • Legacy system migrations where existing Joomla-based filtering logic must be reused.

When to Consider This Package

• Adopt if:

  • Your Laravel app processes HTML input (e.g., WYSIWYG editors, user avatars) and requires configurable XSS protection beyond Laravel’s built-in e() or strip_tags().
  • You need tag/attribute whitelisting (e.g., allow <b>, <i>, but block <script>) without managing a custom solution.
  • Your team lacks expertise in HTML sanitization libraries (e.g., HTMLPurifier) and prefers a lightweight, PHP-native approach.
  • You’re already using Joomla components or need interoperability with Joomla’s ecosystem.

• Look elsewhere if:

  • Your stack uses non-PHP (e.g., Node.js, Python) or relies on Laravel’s native validation (e.g., Illuminate\Validation\Rules\Sanitize) for simple inputs.
  • You require advanced features like DOM parsing (use HTMLPurifier or DOMDocument), real-time filtering (WebSockets), or JavaScript integration.
  • Your PHP version is <8.1 (package drops support for older versions) or you need active maintenance (low stars/dependents signal risk).
  • You prioritize performance-critical paths (this package adds overhead vs. native PHP functions).

How to Pitch It (Stakeholders)

For Executives: "This package lets us deploy secure, configurable HTML sanitization in Laravel without building or maintaining custom XSS protection. It’s a drop-in solution for high-risk inputs like user comments or CMS content, reducing vulnerabilities while cutting dev time. Joomla’s track record in security (despite low stars) and its focus on filtering make it a pragmatic choice—especially if we’re already using PHP. The tradeoff? Minimal maintenance risk vs. zero active development, but the security upside outweighs that for core features."

For Engineering: *"The joomla/filter package gives us a battle-tested way to sanitize HTML inputs in Laravel, with fine-grained control over allowed tags/attributes. Key benefits:

• Out-of-the-box XSS protection: Handles edge cases like XSS evasion characters (since v2.0.6+) and nested tags.
• Laravel-friendly: Works with Composer and can be wrapped in service providers for DI.
• Configurable: Define whitelists/blacklists for tags/attributes via constructor or static methods.
• Lightweight: ~50KB, no heavy dependencies (unlike HTMLPurifier).

Caveats:

• Not Laravel-native: Requires manual integration (e.g., wrapping in a helper).
• Maintenance risk: Low stars/dependents mean we’d need to monitor updates closely (e.g., CVE-2022-23800 was patched but affects older versions).
• PHP 8.1+ only: Blocks use in legacy systems.

Recommendation: Use for critical HTML inputs (e.g., comments, posts) where XSS is a priority, but pair with Laravel’s validation layer for non-HTML fields. Avoid for high-traffic APIs where performance is critical."*

For Security Teams: *"This package addresses A03:2021 Injection (XSS) by providing configurable HTML sanitization with:

• Tag/attribute whitelisting: Explicitly allow only safe elements (e.g., <p>, <a href>).
• XSS evasion mitigation: Strips payloads like javascript:, ', and data: URIs (since v4.0.1).
• Compliance alignment: Reduces attack surface for user-generated content, supporting GDPR (data integrity) and PCI-DSS (input validation).

Mitigations for risks:

• Pin to a specific version (e.g., ~4.0) to avoid breaking changes.
• Combine with Laravel’s e() for output escaping and CSRF tokens for forms.
• Test with OWASP XSS Filter Evasion Cheat Sheet payloads."*