Laravel 5.4+ Middleware to filter user inputs from XSS and iframes and other embed elements.
It does not remove the html, it is only escaped script tags and embeds.
However, by default, it does delete inline event listeners such as onclick.
Optionally they also can be escaped (set escape_inline_listeners to true in xss-filter.php config file).
For example
<html>
<head>
<script src="app.js"></script>
<script>window.init()</script>
<meta name="test" />
<script>
let Iframe = new Iframe('#iframe');
</script>
<head>
<body>
<div class="hover" onhover="show()" data-a="b"><p onclick="click"><span class="span" ondblclick="hide()"></span>Aawfawfaw f awf aw </p></div>
<iframe id="iframe">Not supported!</iframe>
</body>
</html>will be transformed to
<html>
<head>
<script src="app.js"></script>
<script>window.init()</script>
<meta name="test" />
<script>
let Iframe = new Iframe('#iframe');
</script>
<head>
<body>
<div class="hover" data-a="b"><p ><span class="span" ></span>Aawfawfaw f awf aw </p></div>
<iframe id="iframe">Not supported!</iframe>
</body>
</html>This allows to render html in views based on users' input and don't be afraid of XSS attacks and embed elements.
From command line
composer require masterro/laravel-xss-filter
For your Laravel app, open config/app.php and, within the providers array, append:
MasterRO\LaravelXSSFilter\XSSFilterServiceProvider::classwithin the aliases array, append:
'XSSCleaner' => MasterRO\LaravelXSSFilter\XSSCleanerFacade::classFrom command line
php artisan vendor:publish --provider="MasterRO\LaravelXSSFilter\XSSFilterServiceProvider"
You can register \MasterRO\LaravelXSSFilter\FilterXSS::class for filtering in global middleware stack, group middleware stack or for specific routes.
Have a look at Laravel's middleware documentation, if you need any help.
After adding middleware, every request will be filtered.
If you need to specify attributes that should not be filtered add them to xss-filter.except config. By default, filter excepts password and password_confirmation fields.
If you want to clean some value in other place (i.e. Controller) you can use XSSCleaner Facade.
$clean = XSSCleaner::clean($string);XSSCleaner::config()
->allowElement('iframe')
->allowMediaHosts(['youtube.com'])
->blockElement('a');
$clean = XSSCleaner::clean($string);