Filter Laravel Package

Product Decisions This Supports

• Security Compliance (updated, now with patch-SLA implications): Still addresses OWASP Top 10 (A03:2021 Injection) and GDPR/PCI-DSS input-validation obligations for user-generated HTML, but the 3.0.7 release proves the control is not set-and-forget. Two additional filter-bypass classes were patched: whitespace characters in HTML data: URIs and an HTML5 entity-decode mismatch. Product implication: sanitization coverage must be paired with a dependency patch cadence (target: security patch applied within 7–14 days), not treated as a one-time procurement decision.
• Roadmap Efficiency (unchanged): Accelerates rich-text input features (Markdown-to-HTML, WYSIWYG, comments, CMS posts) by supplying pre-built XSS filtering instead of custom regex or strip_tags().
• Build vs. Buy (revised weighting): Still favors buying — no internal team should hand-roll HTML sanitization. However, the recurring bypass history (CVE-2022-23800 plus the two 3.0.7 fixes) means the cost of ownership includes continuous upgrade + regression testing, not just integration. Budget for that in the estimate rather than assuming zero maintenance.
• Maintenance-Risk Signal (materially improved): 3.0.7 is a security backport to the 3.x line, not just a fix on the current major. That is the single most useful datapoint here: the project is actively issuing security patches across maintained branches. This partially retires the earlier "low stars / low dependents = abandonment risk" concern — the risk is real but mitigated by observable security responsiveness. Also corrects the prior claim that pre-PHP 8.1 environments are simply blocked: teams on older PHP runtimes can adopt the patched 3.0.7 branch.
• Use Cases (unchanged): Public-facing forms with HTML input; Laravel CMS/Nova-style tooling needing tag/attribute-level control; Joomla legacy migrations; community platforms (Q&A, wikis, forums) where user HTML is a standing XSS surface.

When to Consider This Package

• Adopt if:

  • Your app accepts user-generated HTML and needs configurable tag/attribute whitelisting beyond Laravel's e() or strip_tags().
  • You can commit to a dependency patch process — pinning to >=4.0.x on PHP 8.1+, or ^3.0.7 on older runtimes, and applying security releases on a defined SLA.
  • Your team lacks HTML-sanitization expertise and would otherwise build a bespoke filter (the worst option available).
  • You need interoperability with Joomla components or reuse of Joomla filtering semantics.
  • You accept defense-in-depth: filter on input, escape with e() on output, and treat sanitization as one layer, not the layer.

• Look elsewhere if:

  • You need a single-vendor-supported sanitizer with a commercial SLA — HTMLPurifier or a maintained DOM-based library remains the safer bet for regulated/high-assurance surfaces.
  • You want no dependency-maintenance overhead at all; if the org cannot run a patch cadence, a managed service or a platform-provided sanitizer is the better structural decision.
  • You require advanced DOM parsing, CSS sanitization, or SVG handling — outside this package's remit.
  • You are on an unpatched 3.x below 3.0.7 or any 4.x release predating the equivalent bypass fixes — do not ship user HTML on those versions.
  • The input is non-HTML or trivially validated (emails, plain text, numeric fields) — Laravel's native validation is sufficient and cheaper.
  • Paths are performance-critical; sanitization adds overhead versus native escaping.

How to Pitch It (Stakeholders)

For Executives: "This package gives us configurable, battle-tested HTML sanitization in Laravel without building or owning XSS protection ourselves. The new 3.0.7 release is actually good news for our risk position: two bypass techniques were found — malformed data: URIs and HTML5 entity mismatches — and the maintainers patched them and backported the fix to the older major branch. That's evidence of an actively security-maintained dependency, not an abandoned one. The decision it drives is that adoption comes with a standing obligation: we pin a patched version and apply security releases within two weeks. Net: lower build cost and lower XSS exposure than custom code, in exchange for a small, budgetable maintenance line item."

For Engineering: *"3.0.7 closes two filter bypasses: whitespace-padded data: URIs and HTML5 entity-decode mismatches. Both are filter-evasion bugs, which tells us the threat model is adversarial input, not just malformed markup. Actions:

• Pin floors: ^3.0.7 for legacy PHP branches; for 4.x confirm the equivalent patches are present before shipping.
• Treat sanitization as defense-in-depth: filter on input, e() on output, CSP headers, and CSRF — do not rely on the filter alone.
• Regression-test the bypass classes on every upgrade using the OWASP XSS Filter Evasion Cheat Sheet, with explicit cases for data: URIs with embedded whitespace/control characters and entity-encoded attribute payloads.
• Wrap it: keep it behind a service provider / helper so a future swap to HTMLPurifier is a one-file change, not a refactor.
• Caveats unchanged: not Laravel-native; adds per-request overhead; 4.x requires PHP 8.1+.

Recommendation: adopt for user-HTML surfaces with a pinned, patched version and a defined patch SLA; keep it behind an abstraction so the vendor decision stays reversible; avoid for plain-text fields and latency-critical APIs."*

For Security Teams: *"3.0.7 patches two XSS filter bypasses — whitespace characters in HTML data: URIs, and an HTML5 entity decode mismatch. Both bypass the whitelist/blacklist enforcement layer, so any deployment below the patched floor should be treated as effectively unsanitized for HTML input. Controls:

• Enforce version floors in CI (^3.0.7 minimum on 3.x); fail builds on known-vulnerable versions.
• Subscribe to advisory feeds for this package; the bypass history (CVE-2022-23800 plus these two) suggests continued researcher attention.
• Assume future bypasses are likely: maintain output escaping and a restrictive CSP as independent controls.
• Validate against the OWASP XSS Filter Evasion Cheat Sheet, specifically entity-encoding and URI-scheme evasion vectors, on each upgrade.
• Compliance framing: supports GDPR data-integrity and PCI-DSS input-validation requirements, provided patch management is evidenced."*