Purifier Laravel Package

Product Decisions This Supports

• User-Generated Content (UGC) Safety: Mitigates XSS attacks in comments, forums, or rich-text fields by sanitizing HTML input while preserving safe formatting (e.g., bold, links, lists).
• Compliance & Standards: Enforces W3C-compliant HTML output for CMS, blogs, or marketing tools where consistency is critical.
• WYSIWYG Editor Integration: Enables secure use of editors (e.g., TinyMCE, CKEditor) by stripping malicious scripts while allowing rich formatting.
• Data Integrity in Eloquent Models: Automatically sanitizes HTML fields during save()/update() via custom casts (e.g., CleanHtmlInput), reducing manual validation boilerplate.
• Dynamic Configuration: Supports tailored purification rules (e.g., allowing YouTube embeds in one field, strict formatting in another) via config presets.
• Performance Optimization: Caches purification rules to reduce overhead for high-traffic sites (e.g., news platforms, Q&A sites).
• Roadmap: Justify investment in UGC features by demonstrating built-in security controls (e.g., "We’ll support embeds via Purifier’s URI filters").

When to Consider This Package

• Avoid if:
  • Your app doesn’t accept HTML input (e.g., pure text fields, APIs with JSON-only responses).
  • You need real-time validation (Purifier is synchronous; consider async queues for bulk processing).
  • Your stack uses non-Laravel PHP (e.g., Symfony, WordPress plugins).
  • You require fine-grained CSP integration (Purifier sanitizes HTML but doesn’t generate CSP headers).
• Look elsewhere if:
  • You need schema validation (e.g., JSON/YAML) → Use spatie/array-to-xml or symfony/yaml.
  • You prioritize minimalism → Consider htmlpurifier/htmlpurifier directly (but lose Laravel conveniences).
  • Your use case is non-HTML (e.g., URL sanitization) → Use str helpers or zendframework/zend-validator.

How to Pitch It (Stakeholders)

For Executives: "This package lets us safely enable rich user content (e.g., comments, articles) without exposing the business to XSS risks. It’s battle-tested, integrates seamlessly with Laravel, and reduces dev time by automating HTML sanitization—like a firewall for user-generated HTML. For example, we can allow bold/italic formatting in customer reviews while blocking <script> tags, all with zero manual validation code."

For Engineering: *"Purifier wraps HTMLPurifier, a battle-hardened library, into Laravel-friendly helpers. Key benefits:

• Zero setup for L5.5+ (auto-discovered).
• Eloquent casts (CleanHtmlInput, CleanHtmlOutput) for automatic model sanitization.
• Config-driven rules: Define allowed tags/attributes per field (e.g., youtube preset for embeds).
• Performance: Caches rules in storage/app/purifier to avoid reprocessing.
• Extensible: Supports URI filters (e.g., whitelisting specific domains) and custom HTML5 definitions. Tradeoff: Adds ~1MB to vendor size (negligible for most apps)."*