Purify Laravel Package

Product Decisions This Supports

• Security Hardening: Enables sanitization of user-generated HTML content (e.g., comments, rich-text fields) to mitigate XSS attacks, aligning with security-first product roadmaps.
• Rich Text Editing: Supports WYSIWYG editors (e.g., Trix, CKEditor) by customizing allowed HTML/CSS, reducing friction for content creators.
• Build vs. Buy: Avoids reinventing HTML sanitization wheels; leverages battle-tested HTMLPurifier with Laravel-native integration.
• Compliance: Meets GDPR/CCPA requirements for sanitizing user input before storage/rendering (e.g., "sanitize on the way out" best practice).
• Performance: Caching definitions reduces runtime overhead in high-traffic applications (e.g., blogs, forums).
• Multi-Tenant Configs: Supports dynamic sanitization rules per feature (e.g., strict for admin panels, lenient for public comments).

When to Consider This Package

• Avoid if:
  • Your app doesn’t accept user-generated HTML (e.g., pure forms/text fields).
  • You need real-time sanitization (e.g., live preview editors) and prefer client-side solutions (e.g., DOMPurify).
  • Your stack doesn’t use Laravel/PHP (e.g., Node.js, Python).
  • You require advanced schema validation beyond HTML/CSS (e.g., MathML, SVG with complex rules).
• Look elsewhere if:
  • You need fine-grained attribute-level sanitization (e.g., whitelisting only class="safe-*"); consider custom regex or a dedicated parser.
  • Your team lacks PHP/Laravel expertise to configure HTMLPurifier’s nuances.
  • You’re constrained by legacy PHP versions (<7.4) or Laravel (<7.0).

How to Pitch It (Stakeholders)

Executives

"This package lets us safely enable rich user content (e.g., comments, articles) without exposing our app to XSS attacks. It’s like a ‘sanitization firewall’ for HTML—built into Laravel, so no extra dev time. For example, we can let users format text with Trix editor while blocking malicious scripts. It’s used by high-traffic sites like Basecamp, and the MIT license means no hidden costs."

Key Outcomes:

• Reduces security incidents from user input.
• Enables better UX (rich text) without risk.
• Low maintenance (Laravel-native, actively updated).

Engineering

*"Purify wraps HTMLPurifier, a robust HTML sanitizer, with Laravel-friendly features:

• Facade-based API: Purify::clean($input) for strings/arrays.
• Config per use case: Define strict rules for admin panels vs. lenient rules for public comments.
• Caching: Auto-caches definitions for performance (clearable via php artisan purify:clear).
• Custom rules: Extend HTML/CSS definitions (e.g., support Trix editor’s <figure> tags).
• Eloquent integration: Auto-sanitize model attributes on get/set via casts (PurifyHtmlOnGet).

Trade-offs:

• Adds ~1MB to vendor size (HTMLPurifier dependency).
• Requires initial config tweaks for edge cases (e.g., AutoFormat behavior).

Quick Start:

composer require stevebauman/purify
php artisan vendor:publish --provider="Stevebauman\Purify\PurifyServiceProvider"

Then sanitize input:

$safeHtml = Purify::clean(request('content'));
```"*