microweber-packages / microweber-security

v1.0.0 2026-11-03 11:18 UTC

Requires

• php: ^8.2
• ezyang/htmlpurifier: ^4.18
• illuminate/support: ^10.0|^11.0|^12.0|^13.0
• microweber-packages/microweber-package: *
• spatie/laravel-package-tools: ^1.16
• symfony/html-sanitizer: ^7.0
• voku/anti-xss: ^4.1

Requires (Dev)

• larastan/larastan: ^3.9
• orchestra/testbench: ^8.0|^9.0|^10.0
• phpunit/phpunit: ^10.0|^11.0

Replaces

• microweber-packages/security: *

MIT

• Microweber
• Bozhidar Slaveykov

Published on Packagist.org on 2026-11-03 11:30 UTC

README

A reusable Laravel package providing HTML sanitization, XSS cleaning, and stored-XSS stripping.

Installation

composer require microweber-packages/microweber-security

The package auto-discovers its service provider via Laravel's package discovery.

Usage

StoredXssStripper

Defense-in-depth pass that strips stored-XSS vectors from HTML strings:

use MicroweberPackages\Security\StoredXssStripper;

$safe = StoredXssStripper::strip('<img src=x onerror=alert(1)>');
// Result: '<img src=x>'

XSSClean

Full XSS cleaning using voku/anti-xss with curated blocklists:

use MicroweberPackages\Security\XSSClean;

$cleaner = new XSSClean();
$safe = $cleaner->clean($userInput);

HtmlClean

HTML sanitization using Symfony HtmlSanitizer with Microweber-specific element/attribute allowlists:

use MicroweberPackages\Security\HtmlClean;

$cleaner = new HtmlClean();
$safe = $cleaner->clean($html);

// Admin mode (allows more elements):
$safe = $cleaner->clean($html, ['admin_mode' => true]);

HtmlSanitizer Components

The package includes customizable HTML sanitizer components:

• MwHtmlSanitizer — Custom HTML sanitizer implementation
• MwHtmlSanitizerConfig — Configuration with Microweber element/attribute allowlists
• MwHtmlSanitizerReference — Reference lists for allowed/blocked attributes
• MwHtmlSanitizerDomVisitor — Custom DOM visitor for sanitization
• MwHtmlSanitizerDomNode — Custom DOM node rendering
• MwAttrbuteSanitizer — Attribute-level sanitizer

Testing

composer test

License

MIT

Standalone validation

A minimal Laravel (Orchestra Testbench) app lives in standalone-validation/:

cd standalone-validation
composer install
./vendor/bin/phpunit

Static analysis

# From monorepo root (level 7 maximized)
composer analyse -- packages/microweber-security/src
# Or package config
../../vendor/bin/phpstan analyse -c phpstan.neon.dist