Repository files navigation

Laravel Middleware to protect your app against Cross-site scripting (XSS). It sanitizes request input by utilising thevoku/anti-xss package, and it can sanatizeBlade echo statements as well. This package was inspired by theSecurity Core package.

• PHP 8.2 and higher
• Laravel 10 and higher

❤️ We proudly support the community by developing Laravel packages and giving them away for free. If this package saves you time or if you're relying on it professionally, please considersponsoring the maintenance and development and check out our latest premium package:Inertia Table. Keeping track of issues and pull requests takes time, but we're happy to help!

You can install the package via composer:

composer require protonemedia/laravel-xss-protection

You may publish the config file with:

php artisan vendor:publish --tag="xss-protection-config"

You may use theProtoneMedia\LaravelXssProtection\Middleware\XssCleanInput middleware in the route that handles the form submission.

useApp\Http\Controllers\CreateAccountController;useProtoneMedia\LaravelXssProtection\Middleware\XssCleanInput;Route::post('account', CreateAccountController::class)->middleware(XssCleanInput::class);

If your app has a lot of forms handled by many different controllers, you could opt to register it as global middleware.

// inside app\Http\Kernel.phpprotected$middleware = [// ...   \ProtoneMedia\LaravelXssProtection\Middleware\XssCleanInput::class,];

If you register the middleware globally, you may exclude requests by using the staticskipWhen method. You can add a callback to interact with the request:

XssCleanInput::skipWhen(function (Request$request) {return$request->is('admin.*');});

You can also exclude keys by using the staticskipKeyWhen method. This also allows you to interact with the value and request.

XssCleanInput::skipKeyWhen(function (string$key,$value,Request$request) {returnin_array($key, ['current_password','password','password_confirmation',    ]);});

By default, the middleware allows file uploads. However, you may disallow file uploads by changing themiddleware.allow_file_uploads configuration key tofalse.

By default, the middleware sanitizesBlade echo statements like{{ $name }},{{{ $name }}}, and{!! $name !!}. You may allow echo statements by changing themiddleware.allow_blade_echoes configuration key totrue.

By default, the middleware transforms malicious input tonull. You may configure the middleware to only transform the malicious part by setting themiddleware.completely_replace_malicious_input configuration key tofalse. That way, an input string likehey <script>alert('laravel')</script> will be transformed tohey instead ofnull.

Instead of transforming malicious input, you may configure the middleware to terminate the request whenever anything malicious has been found. You may do this by setting themiddleware.terminate_request_on_malicious_input totrue, which will throw anHttpException with status code 403.

You may configure the middleware to dispatch an event whenever malicious input has been found. Setting themiddleware.dispatch_event_on_malicious_input totrue will dispatch anProtoneMedia\LaravelXssProtection\Events\MaliciousInputFound event with the sanitized keys, the original request and the sanitized request.

useIlluminate\Support\Facades\Event;useProtoneMedia\LaravelXssProtection\Events\MaliciousInputFound;Event::listen(function (MaliciousInputFound$event) {$event->sanitizedKeys;$event->originalRequest;$event->sanitizedRequest;});

As of version 1.6.0, you may provide additional configuration for thevoku/anti-xss package. You may do this by filling themiddleware.anti_xss key.

'anti_xss' => ['evil' => ['attributes' => ['href'],'tags' => ['video'],    ],'replacement' =>'*redacted*',]

Please seeCHANGELOG for more information about what has changed recently.

$ composertest

Please seeCONTRIBUTING for details.

• Inertia Table: The Ultimate Table for Inertia.js with built-in Query Builder.
• Laravel Blade On Demand: Laravel package to compile Blade templates in memory.
• Laravel Cross Eloquent Search: Laravel package to search through multiple Eloquent models.
• Laravel Eloquent Scope as Select: Stop duplicating your Eloquent query scopes and constraints in PHP. This package lets you re-use your query scopes and constraints by adding them as a subquery.
• Laravel FFMpeg: This package provides an integration with FFmpeg for Laravel. The storage of the files is handled by Laravel's Filesystem.
• Laravel MinIO Testing Tools: Run your tests against a MinIO S3 server.
• Laravel Mixins: A collection of Laravel goodies.
• Laravel Paddle: Paddle.com API integration for Laravel with support for webhooks/events.
• Laravel Task Runner: Write Shell scripts like Blade Components and run them locally or on a remote server.
• Laravel Verify New Email: This package adds support for verifying new email addresses: when a user updates its email address, it won't replace the old one until the new one is verified.

If you discover any security-related issues, please emailcode@protone.media instead of using the issue tracker. Please do not email any questions, open an issue if you have a question.

• Pascal Baljet
• All Contributors

The MIT License (MIT). Please seeLicense File for more information.

This package isTreeware. If you use it in production, then we ask that youbuy the world a tree to thank us for our work. By contributing to the Treeware forest you’ll be creating employment for local families and restoring wildlife habitats.