Download the PHP package aichadigital/laravel-mustache-resolver without Composer

Laravel Mustache Resolver

Development happens on gitlab.castris.com. The GitHub repository is a read-only distribution mirror: issues and pull requests opened there are not seen.

A framework-agnostic, fully testable, SOLID-compliant mustache template resolver for PHP applications with first-class Laravel integration.

Features

• Simple field resolution: {{User.name}}
• Relation navigation: {{User.department.manager.name}}
• Dynamic fields: {{Device.$manufacturer.field_parameter}}
• Collection access: {{User.posts.0.title}}, {{User.addresses.*.city}}
• Built-in functions: {{now()}}, {{format(User.date, 'Y-m-d')}}
• Null coalescing: {{User.nickname ?? 'Anonymous'}}
• Framework-agnostic core with optional Laravel integration
• 100% testable without database

Compatibility

Upgrading from 2.x? Read UPGRADE-3.md first — v3 enforces by default, blocks whole-container serialization, and changes the types in getResolvedValues(). A config published under v2 keeps its own mode (you must flip it to enforce yourself); absent v3 keys are filled with safe defaults at runtime, with a boot warning naming them.

Requirements

• PHP 8.2+
• Laravel 12.x or 13.x (optional)

Installation

Laravel

The package auto-discovers the service provider. Optionally publish the config:

Standalone (without Laravel)

Usage

Basic Usage with Laravel Facade

Relation Navigation

Collection Access

With Variables

Batch Processing

Non-strict Mode

Configuration

Security

v3 enforces by default. Every resolved value passes two barriers: the accessors validate each path before data is touched (barrier 1 — it also prevents the lazy relation query), and an OutputSanitizer downstream of every resolver decides what reaches both the rendered text and getResolvedValues() (barrier 2 — a resolver cannot bypass it). Building any entry point without a validator applies the default policy; opting out requires an explicit mode: 'off'.

The security.mode setting controls what happens on a violation:

• enforce (default): blacklisted paths resolve to empty/null, whole containers are blocked unless escaped, over-limit templates throw SecurityException, disallowed root models throw ModelNotAllowedException. Blocked attempts are logged as an audit trail.
• report: every violation is logged via Log::warning() and resolution proceeds unchanged — output, identity and types stay exactly as with security off. Use it as the measuring tool before flipping to enforce.
• off: no checks are applied, and objects you hand in are returned untouched.

What the policy covers:

• Paths: every segment of a dot-notation path is checked against blacklisted_attributes (exact, case-insensitive) and blacklisted_patterns (glob, case-insensitive) — a blacklisted attribute is also blocked behind a relation ({{User.relationship.password}}) and inside collection tokens ({{User.posts.*.author.password}}). Paths deeper than max_depth are rejected.
• Containers: a token resolving to a whole Model, Collection, array or Arrayable/Traversable/JsonSerializable is blocked by default. Escapes: allow_container_serialization (plain arrays/Collections only) or the SafeForTemplateSerialization interface (the only way a Model opts in). Authorised containers are still filtered recursively and depth-pruned.
• Objects: only DateTimeInterface (Carbon), enums and classes marked SafeForTemplateSerialization count as atomic scalars. Any other object — Stringable included — takes the container gate: an opaque __toString() is not trust.
• Ceilings: security.limits bounds template length (bytes) and token count at parse time, in enforce only, for the main path and compound USE expressions alike.
• Your own accessors/contexts: a DataAccessorInterface or ContextInterface handed straight to translate() is decorated with the resolver's policy (never weakening the accessor's own), because two token types (?? defaults and $dynamic fields) carry no static path for barrier 2 to re-check.

Consumer-registered resolvers are trusted code, outside the threat model — the policy defends against data exposure through templates, not against code you installed. Repeated violations of the same path are logged once per request/job cycle. An invalid security.mode value fails closed (enforce) with a warning, and the boot warning always states the effective mode.

Upgrading from 2.x: the full break-by-break list, the observation procedure and the rollback path live in UPGRADE-3.md.

Custom Resolvers

Register in config:

Testing

Changelog

Please see CHANGELOG for more information on what has changed recently.

Contributing

Please see CONTRIBUTING for details.

Security Vulnerabilities

Please review our security policy on how to report security vulnerabilities.

Credits

• AichaDigital
• All Contributors

License

The AGPL-3.0-or-later License. Please see License File for more information.