Laravel XSS Protection Middleware

Laravel Middleware to protect your app against Cross-site scripting (XSS). It sanitizes request input by utilising the Laravel Security package, and it can sanatize Blade echo statements as well.

• Support for PHP 8.0 and higher
• Support for Laravel 9 and higher

Sponsor this package!

❤️ We proudly support the community by developing Laravel packages and giving them away for free. If this package saves you time or if you're relying on it professionally, please consider sponsoring the maintenance and development. Keeping track of issues and pull requests takes time, but we're happy to help!

Laravel Splade

Did you hear about Laravel Splade? 🤩

It's the magic of Inertia.js with the simplicity of Blade. Splade provides a super easy way to build Single Page Applications using Blade templates. Besides that magic SPA-feeling, it comes with more than ten components to sparkle your app and make it interactive, all without ever leaving Blade.

Installation

You can install the package via composer:

composer require protonemedia/laravel-xss-protection

You may publish the config file with:

php artisan vendor:publish --tag="xss-protection-config"

Middleware Usage

You may use the ProtoneMedia\LaravelXssProtection\Middleware\XssCleanInput middleware in the route that handles the form submission.

use App\Http\Controllers\CreateAccountController;
use ProtoneMedia\LaravelXssProtection\Middleware\XssCleanInput;

Route::post('account', CreateAccountController::class)->middleware(XssCleanInput::class);

If your app has a lot of forms handled by many different controllers, you could opt to register it as global middleware.

// inside app\Http\Kernel.php

protected $middleware = [
   // ...
   \ProtoneMedia\LaravelXssProtection\Middleware\XssCleanInput::class,
];

If you register the middleware globally, you may exclude requests by using the static skipWhen method. You can add a callback to interact with the request:

XssCleanInput::skipWhen(function (Request $request) {
    return $request->is('admin.*');
});

You can also exclude keys by using the static skipKeyWhen method. This also allows you to interact with the value and request.

XssCleanInput::skipKeyWhen(function (string $key, $value, Request $request) {
    return in_array($key, [
        'current_password',
        'password',
        'password_confirmation',
    ]);
});

Configuration

File uploads

By default, the middleware allows file uploads. However, you may disallow file uploads by changing the middleware.allow_file_uploads configuration key to false.

Blade echo statements

By default, the middleware sanitizes Blade echo statements like {{ $name }}, {{{ $name }}}, and {!! $name !!}. You may allow echo statements by changing the middleware.allow_blade_echoes configuration key to true.

Completely replace malicious input

By default, the middleware transforms malicious input to null. You may configure the middleware to only transform the malicious part by setting the middleware.completely_replace_malicious_input configuration key to false. That way, an input string like hey <script>alert('laravel')</script> will be transformed to hey instead of null.

Terminate request

Instead of transforming malicious input, you may configure the middleware to terminate the request whenever anything malicious has been found. You may do this by setting the middleware.terminate_request_on_malicious_input to true, which will throw an HttpException with status code 403.

Dispatch event

You may configure the middleware to dispatch an event whenever malicious input has been found. Setting the middleware.dispatch_event_on_malicious_input to true will dispatch an ProtoneMedia\LaravelXssProtection\Events\MaliciousInputFound event with the sanitized keys, the original request and the sanitized request.

use Illuminate\Support\Facades\Event;
use ProtoneMedia\LaravelXssProtection\Events\MaliciousInputFound;

Event::listen(function (MaliciousInputFound $event) {
    $event->sanitizedKeys;
    $event->originalRequest;
    $event->sanitizedRequest;
});

Changelog

Please see CHANGELOG for more information about what has changed recently.

Testing

$ composer test

Contributing

Please see CONTRIBUTING for details.

Other Laravel packages

• Laravel Analytics Event Tracking: Laravel package to easily send events to Google Analytics.
• Laravel Blade On Demand: Laravel package to compile Blade templates in memory.
• Laravel Cross Eloquent Search: Laravel package to search through multiple Eloquent models.
• Laravel Eloquent Scope as Select: Stop duplicating your Eloquent query scopes and constraints in PHP. This package lets you re-use your query scopes and constraints by adding them as a subquery.
• Laravel Eloquent Where Not: This Laravel package allows you to flip/invert an Eloquent scope, or really any query constraint.
• Laravel FFMpeg: This package provides integration with FFmpeg for Laravel. The storage of the files is handled by Laravel's Filesystem.
• Laravel Form Components: Blade components to rapidly build forms with Tailwind CSS Custom Forms and Bootstrap 4. Supports validation, model binding, default values, translations, includes default vendor styling and fully customizable!
• Laravel Mixins: A collection of Laravel goodies.
• Laravel Paddle: Paddle.com API integration for Laravel with support for webhooks/events.
• Laravel Verify New Email: This package adds support for verifying new email addresses: when a user updates its email address, it won't replace the old one until the new one is verified.
• Laravel WebDAV: WebDAV driver for Laravel's Filesystem.

Security

If you discover any security-related issues, please email code@protone.media instead of using the issue tracker. Please do not email any questions, open an issue if you have a question.

Credits

• Pascal Baljet
• All Contributors

License

The MIT License (MIT). Please see License File for more information.

Treeware

This package is Treeware. If you use it in production, then we ask that you buy the world a tree to thank us for our work. By contributing to the Treeware forest you’ll be creating employment for local families and restoring wildlife habitats.