- Your application features a Rich Text Editor and you want to prevent all XSS.
- You want full HTML5 & CSS3 support.
- You want to allow all safe HTML elements, their attributes, and CSS properties without going deep into whitelist configs.
The default driver aligns with OWASP recommendations:
... OWASP recommends DOMPurify for HTML Sanitization.
- PHP >= 8.2
- ext-json
- Node >= 18
- NPM
Install the package via composer:
composer require medilies/xsslessFor non Laravel projects, pick a config and run the following code:
$config = new Medilies\Xssless\Dompurify\DompurifyCliConfig('node', 'npm');
(new Medilies\Xssless\Xssless)
->using($config)
->setup();For Laravel projects, run the following command:
php artisan xssless:setupUsing Medilies\Xssless\Dompurify\DompurifyCliConfig:
(new Medilies\Xssless\Xssless)
->using(new Medilies\Xssless\Dompurify\DompurifyCliConfig)
->clean($html);Using Medilies\Xssless\Dompurify\DompurifyServiceConfig:
$config = new Medilies\Xssless\Dompurify\DompurifyServiceConfig(
host: '127.0.0.1',
port: 63000
);
$xssless = (new Medilies\Xssless\Xssless)
->using($config);
/**
* It is better to have this part in a separate script
* that runs continuously and independently from your app
*/
$xssless->start();
$xssless->clean($html);You can publish the config file with:
php artisan vendor:publish --tag="xssless-config"This is the contents of the published config file:
return [
'default' => 'dompurify-cli',
'drivers' => [
'dompurify-cli' => new DompurifyCliConfig(
node: env('NODE_PATH', 'node'), // @phpstan-ignore argument.type
npm: env('NPM_PATH', 'npm'), // @phpstan-ignore argument.type
binary: null,
tempFolder: null,
),
'dompurify-service' => new DompurifyServiceConfig(
node: env('NODE_PATH', 'node'), // @phpstan-ignore argument.type
npm: env('NPM_PATH', 'npm'), // @phpstan-ignore argument.type
host: '127.0.0.1',
port: 63000,
binary: null,
),
],
];Run the following command (Not required by all drivers):
php artisan xssless:startUse the facade:
Medilies\Xssless\Laravel\Facades\Xssless::clean($html);Please see CHANGELOG for more information on what has changed recently.
Please see CONTRIBUTING for details.
Please review our security policy on how to report security vulnerabilities.
The MIT License (MIT). Please see License File for more information.