- How do I sanitize SVG uploads in a Laravel controller to prevent XSS?
- Use the `DOMSanitizer::SVG` mode in your controller or service. Example: `$sanitizer = new DOMSanitizer(DOMSanitizer::SVG); $cleanSVG = $sanitizer->sanitize($request->file('svg')->get());`. For stricter control, disable namespaces with `'remove-namespaces' => true`.
- Will this package work with Laravel 8+ and PHP 8.1?
- Yes, it’s fully compatible with Laravel 8+ and PHP 8.1. The package requires PHP 7.3+, but no Laravel-specific features are used, so it integrates seamlessly. Test edge cases like SVG filters or MathML entities if your app uses them.
- Can I customize allowed SVG attributes for a specific use case (e.g., scientific diagrams)?
- Absolutely. Use `addAllowedAttributes()` to whitelist custom attributes. Example: `$sanitizer->addAllowedAttributes(['xlink:href' => ['href']])` for SVG links. Audit your allowlists with real-world SVGs to avoid false positives.
- How does this compare to Laravel’s built-in `Str::of()` or `htmlspecialchars()` for sanitization?
- This package is far more robust for complex markup like SVG/XML. `Str::of()` and `htmlspecialchars()` only handle basic HTML, while `rhukster/dom-sanitizer` uses DOMDocument to parse and validate nested structures, removing dangerous tags/attributes entirely.
- Is there a performance impact when sanitizing large XML files in production?
- DOM parsing adds ~5–10ms per request. For high-volume XML (e.g., CMS content), offload sanitization to Laravel queues or use middleware to cache sanitized outputs. Benchmark with your specific payloads to optimize.
- How do I integrate this into Laravel middleware for automatic request/response sanitization?
- Create middleware like `SanitizeXML` and inject the sanitizer. Example: `if ($request->isXml()) { $request->merge(['content' => app(DOMSanitizer::class)->sanitize($request->content)]); }`. Register it in `app/Http/Kernel.php` under `$middleware`.
- Does this package protect against XXE or DoS attacks in XML/SVG inputs?
- Yes, but with caveats. The package mitigates risks via `LIBXML_NONET` and `libxml_disable_entity_loader()` (fixed in 1.0.11+). Avoid custom XML schemas/DTDs unless pre-processed. For critical apps, validate inputs before sanitization.
- Can I use this to sanitize MathML equations in a Laravel API response?
- Yes, initialize the sanitizer with `DOMSanitizer::MATHML`. Example: `$sanitizer = new DOMSanitizer(DOMSanitizer::MATHML); $cleanMathML = $sanitizer->sanitize($equation, ['compress-output' => false]);`. Customize allowed tags if your equations use non-standard elements.
- How do I handle unsanitizable content (e.g., malformed SVG) in a Laravel app?
- Configure a fallback strategy in your service layer. Example: `try { return $sanitizer->sanitize($svg); } catch (Exception $e) { Log::error($e); return response()->json(['error' => 'Invalid SVG'], 400); }`. Test with edge cases like empty inputs or nested entities.
- Are there alternatives to this package for Laravel SVG sanitization?
- Alternatives include `masterminds/html5` (less SVG-specific) or `symfony/dom` (requires manual sanitization logic). This package stands out for its DOMPurify-inspired allowlists, SVG/MathML support, and Laravel-friendly API. For lightweight needs, `htmlspecialchars()` may suffice, but it lacks DOM validation.