purifier 常用配置 保留 id 和 iframe

项目地址

https://github.com/mewebstudio/Purifier

Purifier 是针对 Laravel 框架的 HTML 过滤器，修复 XSS 漏洞

安装

composer require mews/purifier

生成配置

php artisan vendor:publish --provider="Mews\Purifier\PurifierServiceProvider"

自定义配置

config/purifier.php

'default' => [
    'HTML.Doctype'             => 'HTML 4.01 Transitional',
    'HTML.Allowed'             => 'div,b,strong,i,em,a[href|title],ul,ol,ol[start],li,p[style],br,span[style],img[width|height|alt|src],*[style|class],pre,hr,code,h1[id],h2,h3,h4,h5,h6,blockquote,del,table,thead,tbody,tr,th,td,iframe[width|height|src|frameborder|scrolling|allowfullscreen]',
    'CSS.AllowedProperties'    => 'font,font-size,font-weight,font-style,margin,width,height,font-family,text-decoration,padding-left,color,background-color,text-align',
    'AutoFormat.AutoParagraph' => true,
    'AutoFormat.RemoveEmpty'   => true,
    'Attr.EnableID' => true,
    'HTML.SafeIframe' => true,
    'URI.SafeIframeRegexp' => "%^(http://|https://|//)(www.youtube.com/embed/|player.bilibili.com)%",
],

配置说明

'Attr.EnableID' => true, 保留 id 属性
'HTML.SafeIframe' => true, 保留 iframe 标签
'URI.SafeIframeRegexp' => "%^(http://|https://|//)(www.youtube.com/embed/|player.bilibili.com)%", 允许的 iframe 地址

调用clean方法

$article->body = clean($article->body);