Weave Code
Htmlawed Laravel Package
vanilla/htmlawed
Laravel integration for HTMLawed, a PHP HTML sanitizer and validator. It cleans user-submitted markup, balances tags, filters unsafe attributes and elements, and helps preserve safe formatting in rich text. Useful for sanitizing comments, CMS content, and other untrusted HTML.
Composer-compatible fork of the htmLawed library to purify & filter HTML.
Frequently asked questions about Htmlawed
- How do I install vanilla/htmlawed in a Laravel app?
- Install it with Composer using composer require vanilla/htmlawed. After that, the core call is Htmlawed::filter($html, $config, $spec), which you can wrap in your own service or adapter. The package is a thin wrapper, so expect to wire policy and container bindings yourself rather than relying on a full Laravel package scaffold.
- Does vanilla/htmlawed include a Laravel service provider and facade?
- The package overview advertises Laravel service provider and facade integration, but the technical assessment notes that the integration surface is essentially one method and that you may need to bind it yourself. Verify what the installed version actually registers by checking its composer.json and source. If no provider is present, create a small service provider that binds an HtmlSanitizer interface to an adapter around Htmlawed::filter.
- How do I configure allowed tags and attributes with htmLawed?
- Define an allowed-tag and allowed-attribute matrix per content type, then encode it in htmLawed's config array and spec string. Keep those rules in one place, such as a Laravel config file or your own policy class, so every sanitization path reuses them. Because htmLawed spec strings are terse, review any change against a payload corpus to avoid silently widening the allowlist.
- Which Laravel and PHP versions does vanilla/htmlawed support?
- The provided material does not list a specific Laravel or PHP version matrix. Check the package's composer.json constraints and run your test suite on the exact Laravel and PHP versions you deploy. If you are on PHP 8.3, confirm that the vendored htmLawed file produces no deprecation notices in your logs.
- Can vanilla/htmlawed sanitize comments and CMS content safely?
- It can, provided you define a strict policy for each content type and validate the output. htmLawed balances tags, repairs malformed markup, and filters unsafe elements and attributes, which suits comments, CMS bodies, and rich-text fields. Treat it as one layer: combine it with output encoding, a Content Security Policy, and limited HTML privileges for authors.
- How should I test HTML sanitization rules in Laravel?
- Build a regression corpus that includes known XSS payloads, malformed markup, and legitimate rich-text samples for every content type. Write tests that assert the exact sanitized output for each policy, not just that dangerous strings are absent. Re-run the corpus whenever you upgrade the package or change htmLawed configuration.
- Is vanilla/htmlawed production-ready for untrusted HTML?
- It is usable in production with conditions: pin the version, review diffs before upgrading, and keep a sanitizer regression suite. The main concerns are the thin single-maintainer fork acting as your trust boundary, and opaque upstream syncs that can change behavior. Use defense in depth so a sanitizer gap is not your only protection.
- What are alternatives to vanilla/htmlawed for sanitizing HTML in Laravel?
- Common options include HTMLPurifier, Symfony's HtmlSanitizer component, and Laravel wrappers such as mews/purifier that bundle HTMLPurifier. Client-side sanitizers like DOMPurify are useful but do not replace server-side filtering. Compare allowlist ergonomics, maintenance cadence, license, and test coverage before switching.
- How actively is vanilla/htmlawed maintained?
- Maintenance is bursty and driven by Vanilla's product needs rather than by a public CVE response schedule. One release jumped from v2.2.5 to v2.2.15, bundling ten upstream htmLawed releases in a single update, which suggests long gaps between syncs. Budget time to read upstream changelogs and diff the vendored file when you upgrade.
- What license does vanilla/htmlawed use, and can I use it commercially?
- The package metadata has reported NOASSERTION, while upstream htmLawed is dual-licensed under GPL and LGPL. Because GPL-family obligations can affect distribution of an application that stores user-generated HTML, treat licensing as a go/no-go review with legal counsel. Do not assume a routine version bump resolves the licensing question.
Weaver
How can I help you explore Laravel packages today?