HTML Sanitizer

[tonysm]

Looks like Symfony has a stable release of their HTML Sanitizer. I was wondering if it wouldn't be cool to have something like that upstream in the Laravel core. Maybe something like:

{{ s($post->body) }}

Assuming the body field there has HTML on it, the s() function would sanitize the content and return an instance of HtmlString.

It could ship only with the Element Baseline and allow app-land code to override it using a callable, something like:

use Illuminate\View\HtmlSanitizer;
use Symfony\Component\HtmlSanitizer\HtmlSanitizer as SymfonyHtmlSanitizer;
use Symfony\Component\HtmlSanitizer\HtmlSanitizerConfig;

// Somewhere in AppServiceProvider
HtmlSanitizer::configureUsing(fn () => new SymfonyHtmlSanitizer(
    (new HtmlSanitizerConfig())
        ->blockElement('h1')
));

This being in the core would mean more eyes on how sanitization is done.

[jva91]

This would be really nice when a sanitizer option is available in Laravel core. The Symfony Sanitizer looks nice to implement