- How do I install rhukster/dom-sanitizer in a Laravel app?
- Install it with Composer using composer require rhukster/dom-sanitizer. It is a plain PHP package, so no Laravel service provider or configuration file is required. You can instantiate Rhukster\DomSanitizer\DOMSanitizer directly in a controller, service, middleware, or container binding.
- What PHP and Laravel versions does rhukster/dom-sanitizer support?
- The package requires PHP 7.3 or newer. Laravel 8 and later, which require PHP 7.4 or newer, are fully compatible. Older Laravel versions may work but should use runtime checks because the package itself is framework-agnostic.
- How do I sanitize SVG uploads in Laravel with DOMSanitizer?
- Create a DOMSanitizer instance with DOMSanitizer::SVG, then pass the uploaded SVG content to sanitize(). For SVG workflows you can also enable options such as remove-namespaces. Wrap this in an upload service or middleware so every user-supplied SVG passes through the sanitizer before storage or rendering.
- Can DOMSanitizer sanitize HTML as well as SVG and MathML?
- Yes, the package supports HTML, SVG, and MathML modes. HTML is the default mode, while DOMSanitizer::SVG and DOMSanitizer::MATHML limit the allowlists to the relevant tag and attribute sets. Choosing the correct mode is advisable because it reduces the surface area of allowed markup.
- What options can I pass to DOMSanitizer sanitize()?
- The sanitize method accepts an optional options array. Defaults include remove-namespaces set to false, remove-php-tags set to true, remove-html-tags set to true, remove-xml-tags set to true, and compress-output set to true. You can override these per call, such as disabling compress-output for readable MathML output.
- How do I customize allowed tags and attributes in DOMSanitizer?
- The package exposes methods such as addAllowedTags, addAllowedAttributes, addDisallowedTags, addDisallowedAttributes, getAllowedTags, and setAllowedTags. Use these to extend or restrict the DOMPurify-based allowlists for niche SVG, HTML, or MathML requirements. Test custom rules against real-world files because overly strict allowlists can block valid features.
- How can I use DOMSanitizer as Laravel middleware or a service?
- You can bind DOMSanitizer in Laravel's service container for dependency injection or instantiate it inside middleware and service classes. A common pattern is middleware that checks for XML or SVG content, sanitizes the relevant request field, and merges the clean value back. Decide whether unsanitizable content should be logged, rejected with HTTP 400, or replaced with a safe fallback.
- Is rhukster/dom-sanitizer safe against XXE and malicious XML or SVG?
- The package uses PHP DOMDocument and its 1.0.11 fixes include hardening such as LIBXML_NONET and disabling the entity loader. You should still pre-process untrusted XML with custom DTDs or schemas and avoid resolving external entities. Combine sanitization with upload validation, content-type checks, and rejection strategies for defense in depth.
- What is the performance impact of DOM sanitization in Laravel requests?
- DOM parsing adds roughly 5 to 10 milliseconds of overhead per request according to the technical assessment. That is usually acceptable for uploads or occasional XML handling but should be benchmarked for high-volume content. For heavy sanitization work, offload processing to Laravel queue workers instead of doing it inline on every web request.
- Does DOMSanitizer work with Laravel facades and Blade directives?
- There are no built-in Laravel facades or Blade directives in the package. You can create a facade or Blade directive yourself by resolving the sanitizer from the container. Registering a container binding for DOMSanitizer keeps usage concise while preserving dependency injection and testability.