Weave Code
Laravel Image Sanitize Laravel Package
laravel-at/laravel-image-sanitize
Laravel middleware that re-encodes uploaded images to strip hidden malicious payloads, reducing the risk of code execution. Requires PHP 8.3+, Laravel 12/13, and Intervention Image 4.
laravel-at/laravel-image-sanitize is a lightweight middleware that reduces the risk of malicious code execution through uploaded images. It re-encodes incoming image files, stripping embedded payloads before your application ever handles them—inspired by talks on how Laravel apps get hacked.
- Drop-in middleware for any upload route, with optional alias support
- Re-encodes images to neutralize hidden executable code
- Publishable config to tune sanitization behavior
- Modern stack — PHP 8.3+, Laravel 12/13, Intervention Image 4
- Composer install in one command, zero boilerplate
composer require laravel-at/laravel-image-sanitize
Frequently asked questions about Laravel Image Sanitize
- How do I install laravel-at/laravel-image-sanitize in a Laravel app?
- Run composer require laravel-at/laravel-image-sanitize. The package requires PHP 8.3+, Laravel 12 or 13, and Intervention Image 4, so Composer will enforce those constraints at install time. After that, apply the ImageSanitizeMiddleware to your upload routes or register it as an alias in bootstrap/app.php. No migrations, queues, or service provisioning are needed.
- How do I register the image-sanitize middleware alias in bootstrap/app.php?
- Inside the withMiddleware closure in bootstrap/app.php, call $middleware->alias(['image-sanitize' => ImageSanitizeMiddleware::class]). You can then attach ->middleware('image-sanitize') to any route that receives image uploads. Alternatively, pass the fully qualified ImageSanitizeMiddleware class name directly to the middleware method without registering an alias.
- Does this package replace MIME validation and filename checks for uploads?
- No, it is a defense-in-depth layer, not a primary security boundary. It scans allowed image MIME types for byte patterns such as PHP open tags and phar strings, then re-encodes the file through Intervention Image 4 when a match is found. You should still enforce MIME and extension validation, size limits, randomized filenames, non-executable storage, and static-origin isolation.
- Can I customize the patterns the middleware scans for in uploaded images?
- Yes. Publish the config with php artisan vendor:publish --tag=image-sanitize-config, then edit the patterns list and allowed_mime_types array. Because the detection list lives in your application config, it will not be updated automatically when the package ships new patterns, so track upstream changes and review coverage periodically. Treat the pattern list as security-sensitive configuration that needs owners and review.
- What happens when the middleware detects a suspicious pattern in an uploaded file?
- When a listed byte pattern matches, the file is re-encoded with Intervention Image 4 to strip the embedded payload. Files that do not match any literal pattern pass through unmodified, which means obfuscated or polyglot payloads may still reach your application. The sanitize() return type changed in v5, so verify behavior against your pinned version.
- Does laravel-at/laravel-image-sanitize support SVG uploads?
- SVG is not in the default allowed_mime_types list, so SVG files are excluded from sanitization by default. If your product accepts SVG, you need a separate policy, ideally rasterize-only processing or dedicated SVG sanitization. SVG is the highest-risk image format for script injection, so do not simply add it to the config without additional controls.
- What are the performance risks of re-encoding images inside the request cycle?
- Re-encoding happens synchronously in the web worker, and the published config has no pixel-dimension, byte-size, or memory budget. Defaults such as quality 100, decode_animation true, and strip_metadata true favor fidelity over cost. Enforce upload size limits and consider moving sanitization to a queued job for large or animated files to avoid decompression-bomb CPU and memory spikes.
- Which Laravel and PHP versions does this package support?
- The current major requires PHP 8.3+, Laravel 12 or 13, and Intervention Image 4, plus a working GD or Imagick driver in the runtime image. The Intervention 4 constraint is the most common Composer conflict in mature applications. Older package majors map to older framework versions, so match the package major to your Laravel release.
- How do I write tests to confirm uploaded images are actually sanitized?
- Add feature tests that post crafted image fixtures containing PHP tags to a route using the middleware, then assert the stored file no longer contains the payload. Include mixed flat and nested upload fields, since v5 fixed handler defects around repeated nested field names. Asserting this yourself is safer than trusting that the middleware ran, especially after upgrades.
- Is laravel-at/laravel-image-sanitize actively maintained and safe to depend on?
- Quality instrumentation is solid, with GitHub Actions, Pint, PHPStan level 7, and composer check, but the project has a small maintainer pool and a single security contact. Expect a breaking major roughly annually as it tracks Laravel and Intervention Image releases, and verify each published tag against the changelog before pinning. Budget time for lockstep upgrades and keep your own validation layers in place.
Weaver
How can I help you explore Laravel packages today?