ExerciseHTMLPurifierBundle

ExerciseHTMLPurifierBundle integrates the battle-tested HTMLPurifier library into Symfony, giving you a configurable service that filters untrusted HTML down to a safe, standards-compliant subset. It removes malicious markup and script vectors while preserving the formatting you actually want to keep.

The bundle lets you define multiple named purifier profiles in your Symfony configuration, then consume them as services, through a Twig filter, or as a form type extension that cleans submitted rich-text fields automatically. It is the standard way Symfony applications defend against stored and reflected XSS when accepting user-generated HTML.

What You Get

• A default HTMLPurifier service plus unlimited named, inheritable purifier profiles
• A Twig filter/extension for sanitizing HTML directly in templates
• A form type extension that purifies submitted rich-text fields transparently
• A serializer cache warmer that pre-builds HTMLPurifier’s definition cache during deploys
• Configurable cache serializer path and permissions for the HTMLPurifier definition cache

Common Use Cases

• Sanitizing WYSIWYG or rich-text form submissions before persisting them
• Cleaning user-generated HTML rendered in Twig templates
• Enforcing an allow-list of tags and attributes for comments or CMS content
• Preventing stored and reflected XSS in Symfony applications

Under The Hood

Architecture - The ExerciseHTMLPurifierExtension reads bundle configuration and builds one HTMLPurifier service per profile via HTMLPurifierConfigFactory, with the default profile always defined and inherited by others. An HTMLPurifierPass compiler pass and HTMLPurifiersRegistry register and resolve those purifiers by name. Consumption paths include a Twig extension/runtime, a form HTMLPurifierTextTypeExtension wired through an HTMLPurifierListener, and a SerializerCacheWarmer that primes HTMLPurifier’s definition cache.

Tech Stack - PHP 8.1+ built on ezyang/htmlpurifier ~4.14 and Symfony 5.4/6/7/8 components (config, dependency-injection, http-kernel), with optional symfony/form and Twig 2/3 integrations. Services are declared in a PHP config file (Resources/config/services.php).

Code Quality - The project ships a PHPUnit test suite covering the config factory, registry, cache warmer, form, and Twig integrations, plus a qa tooling directory. The code is compact, strictly namespaced under PSR-4, and split cleanly by concern (DI, Form, Twig, CacheWarmer).

API Design - Zero-config usage yields a working exercise_html_purifier.default service, and additional profiles are pure YAML/PHP configuration with inheritance from the default. Sanitizing is then as simple as injecting a purifier, applying a Twig filter, or enabling the form extension, keeping boilerplate minimal.