Download the PHP package protonemedia/laravel-xss-protection without Composer

On this page you can find all versions of the php package protonemedia/laravel-xss-protection. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.

FAQ

After the download, you have to make one include require_once('vendor/autoload.php');. After that you have to import the classes with use statements.

Example:
If you use only one package a project is not needed. But if you use more then one package, without a project it is not possible to import the classes with use statements.

In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.
Some PHP packages are not free to download and because of that hosted in private repositories. In this case some credentials are needed to access such packages. Please use the auth.json textarea to insert credentials, if a package is coming from a private repository. You can look here for more information.

  • Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
  • To use Composer is sometimes complicated. Especially for beginners.
  • Composer needs much resources. Sometimes they are not available on a simple webspace.
  • If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
  • Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.
Please rate this library. Is it a good library?

Informations about the package laravel-xss-protection

Laravel XSS Protection Middleware

Latest Version on Packagist run-tests Total Downloads

Laravel Middleware to protect your app against Cross-site scripting (XSS). It sanitizes request input by utilising the Security Core package, and it can sanatize Blade echo statements as well.

Sponsor Us

❤️ We proudly support the community by developing Laravel packages and giving them away for free. If this package saves you time or if you're relying on it professionally, please consider sponsoring the maintenance and development and check out our latest premium package: Inertia Table. Keeping track of issues and pull requests takes time, but we're happy to help!

Installation

You can install the package via composer:

You may publish the config file with:

Middleware Usage

You may use the ProtoneMedia\LaravelXssProtection\Middleware\XssCleanInput middleware in the route that handles the form submission.

If your app has a lot of forms handled by many different controllers, you could opt to register it as global middleware.

If you register the middleware globally, you may exclude requests by using the static skipWhen method. You can add a callback to interact with the request:

You can also exclude keys by using the static skipKeyWhen method. This also allows you to interact with the value and request.

Configuration

File uploads

By default, the middleware allows file uploads. However, you may disallow file uploads by changing the middleware.allow_file_uploads configuration key to false.

Blade echo statements

By default, the middleware sanitizes Blade echo statements like {{ $name }}, {{{ $name }}}, and {!! $name !!}. You may allow echo statements by changing the middleware.allow_blade_echoes configuration key to true.

Completely replace malicious input

By default, the middleware transforms malicious input to null. You may configure the middleware to only transform the malicious part by setting the middleware.completely_replace_malicious_input configuration key to false. That way, an input string like hey <script>alert('laravel')</script> will be transformed to hey instead of null.

Terminate request

Instead of transforming malicious input, you may configure the middleware to terminate the request whenever anything malicious has been found. You may do this by setting the middleware.terminate_request_on_malicious_input to true, which will throw an HttpException with status code 403.

Dispatch event

You may configure the middleware to dispatch an event whenever malicious input has been found. Setting the middleware.dispatch_event_on_malicious_input to true will dispatch an ProtoneMedia\LaravelXssProtection\Events\MaliciousInputFound event with the sanitized keys, the original request and the sanitized request.

Additional configuration for voku/anti-xss

As of version 1.6.0, you may provide additional configuration for the voku/anti-xss package. You may do this by filling the middleware.anti_xss key. This is similar to the Laravel Security package, which this package used to rely on.

Changelog

Please see CHANGELOG for more information about what has changed recently.

Testing

Contributing

Please see CONTRIBUTING for details.

Other Laravel packages

Security

If you discover any security-related issues, please email [email protected] instead of using the issue tracker. Please do not email any questions, open an issue if you have a question.

Credits

License

The MIT License (MIT). Please see License File for more information.

Treeware

This package is Treeware. If you use it in production, then we ask that you buy the world a tree to thank us for our work. By contributing to the Treeware forest you’ll be creating employment for local families and restoring wildlife habitats.


All versions of laravel-xss-protection with dependencies

PHP Build Version
Package Version
Requires php Version ^8.2|^8.3
graham-campbell/security-core Version ^4.0
illuminate/contracts Version ^10.0|^11.0
spatie/laravel-package-tools Version ^1.9.2
Composer command for our command line client (download client) This client runs in each environment. You don't need a specific PHP version etc. The first 20 API calls are free. Standard composer command

The package protonemedia/laravel-xss-protection contains the following files

Loading the files please wait ....