- How do I integrate this sanitizer into Laravel’s request validation pipeline?
- Use the package in a `FormRequest` class or middleware. For example, in a `FormRequest`, inject the sanitizer via Laravel’s service container and apply it to user-submitted HTML/SVG fields before validation. Alternatively, create middleware to sanitize input globally for API endpoints or uploads.
- Does this package support SVG sanitization for user uploads in Laravel?
- Yes, initialize the sanitizer with `DOMSanitizer::SVG` to restrict processing to SVG-specific tags and attributes. This is ideal for sanitizing uploaded SVG files or dynamic SVG content in Laravel applications. Customize allowed tags/attributes if you need to support specific SVG features like filters or animations.
- Can I use this package with Laravel 8+ and PHP 7.3+?
- Absolutely. The package requires PHP 7.3+ and is fully compatible with Laravel 8, 9, and 10. It leverages PHP’s native DOMDocument, so no additional PHP extensions or dependencies are needed beyond Composer. No breaking changes are expected for supported PHP versions.
- How do I customize allowed tags or attributes for my Laravel app?
- Use the `addAllowedTags()`, `addAllowedAttributes()`, `addDisallowedTags()`, or `addDisallowedAttributes()` methods to modify the default allowlists. For example, if you need to whitelist SVG `<filter>` elements, call `$sanitizer->addAllowedTags(['filter'])` before sanitizing. This is useful for tailoring the sanitizer to specific Laravel feature requirements.
- Is this package secure against XXE attacks in Laravel?
- Yes, the package is hardened against XXE (XML External Entity) attacks by default. It uses `LIBXML_NONET` and `libxml_disable_entity_loader()` to disable external entity processing and network access during parsing. This aligns with Laravel’s security-first approach and mitigates OWASP A03:2021 (Injection) risks.
- How do I benchmark performance for high-volume XML/HTML sanitization in Laravel?
- Test the package with your expected input volume using Laravel’s built-in benchmarking tools or PHP’s `microtime()`. Enable the `compress-output` option to optimize performance for large payloads. For CMS content or bulk uploads, consider caching sanitized output or processing in batches to avoid bottlenecks.
- Can I use this sanitizer in Laravel middleware to protect API endpoints?
- Yes, wrap the sanitizer in middleware to automatically sanitize XML/HTML/SVG input for API endpoints. For example, create middleware that checks for SVG/HTML payloads and applies the sanitizer before processing. This ensures consistent security across all API routes handling untrusted input.
- What happens if the sanitizer encounters malformed XML or HTML in Laravel?
- The package will throw a `DOMException` if the input is malformed. In Laravel, catch this exception in your middleware, request validation, or upload handlers to log errors or reject invalid input. For example, wrap the sanitizer call in a try-catch block to handle edge cases gracefully.
- Are there alternatives to this package for Laravel SVG/HTML sanitization?
- Other options include DOMPurify’s PHP port (less actively maintained) or HTMLPurifier, but this package stands out for its SVG/MathML support, MIT license, and Laravel-friendly design. It’s also lighter weight, avoiding external dependencies beyond Composer, which simplifies integration into Laravel’s ecosystem.
- How do I test the sanitizer in Laravel’s PHPUnit test suite?
- Write unit tests to verify allow/deny lists by comparing sanitized output against expected results. Adapt the package’s regression tests for XXE/CSS injection into your test suite. For example, test SVG uploads by mocking file content and asserting the sanitizer removes dangerous attributes while preserving safe ones.