You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Use what is recommended by [OWASP](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html#html-sanitization):
9
+
10
+
> HTML Sanitization will strip dangerous HTML from a variable and return a safe string of HTML. OWASP recommends DOMPurify for HTML Sanitization.
11
+
12
+
Note that the library is still in its alfa-phase. The methods exposed in this doc will most likely not change, but the configs and the internals may change a lot incase you decide to extend the package or create your own driver.
10
13
11
14
## Installation
12
15
13
-
You can install the package via composer:
16
+
Install the package via composer:
14
17
15
18
```bash
16
19
composer require medilies/xssless
17
20
```
18
21
22
+
For non Laravel projects pick a config and run the following code:
23
+
24
+
```php
25
+
$config = new Medilies\Xssless\Dompurify\DompurifyCliConfig('node', 'npm');
26
+
27
+
(new Medilies\Xssless\Xssless)
28
+
->using($config)
29
+
->setup($html);
30
+
```
31
+
32
+
### Laravel setup
33
+
19
34
You can publish the config file with:
20
35
21
36
```bash
@@ -26,19 +41,74 @@ This is the contents of the published config file:
26
41
27
42
```php
28
43
return [
44
+
'default' => 'dompurify-cli',
45
+
46
+
'cleaners' => [
47
+
'dompurify-cli' => new DompurifyCliConfig(
48
+
env('NODE_PATH', 'node'),
49
+
env('NPM_PATH', 'npm'),
50
+
),
51
+
'dompurify-service' => new DompurifyServiceConfig(
52
+
env('NODE_PATH', 'node'),
53
+
env('NPM_PATH', 'npm'),
54
+
'127.0.0.1',
55
+
63000,
56
+
),
57
+
],
29
58
];
30
59
```
31
60
61
+
Run the following command after picking your `xssless.default` config:
62
+
63
+
```shell
64
+
php artisan xssless:setup
65
+
```
66
+
32
67
## Usage
33
68
69
+
Using `Medilies\Xssless\Dompurify\DompurifyCliConfig`:
70
+
34
71
```php
35
-
$xssless = new Medilies\Xssless();
72
+
$config = new Medilies\Xssless\Dompurify\DompurifyCliConfig('node', 'npm');
73
+
74
+
(new Medilies\Xssless\Xssless)
75
+
->using($config)
76
+
->clean($html);
36
77
```
37
78
38
-
## Testing
79
+
Using `Medilies\Xssless\Dompurify\DompurifyServiceConfig`:
39
80
40
-
```bash
41
-
./vendor/bin/pest
81
+
```php
82
+
$config = new Medilies\Xssless\Dompurify\DompurifyServiceConfig('node', 'npm', '127.0.0.1', 63000);
83
+
84
+
$xssless = (new Medilies\Xssless\Xssless)
85
+
->using($config);
86
+
87
+
/**
88
+
* It is better to have this part in a separate script that runs continuously
89
+
* and independently from your app that manages the HTTP requests or CLI input
90
+
*/
91
+
$xssless->start();
92
+
93
+
$xssless->clean($html);
94
+
```
95
+
96
+
### Laravel usage
97
+
98
+
Using `Medilies\Xssless\Dompurify\DompurifyCliConfig`:
0 commit comments