Mews Purifier

Mews Purifier is a Laravel package that wraps the battle-tested ezyang/htmlpurifier library and exposes it through Laravel’s service container, facade, helper function, and Eloquent casts. It lets you clean untrusted HTML - typically rich-text submitted by users - so that dangerous scripts and malformed markup are removed while safe, standards-compliant tags survive.

Configuration is driven by named rule sets published to config/purifier.php, so you can define different allow-lists for different contexts (comments, article bodies, titles) and apply them by name at the call site. It registers automatically via Laravel package discovery and works from Laravel 5 through 13.

What You Get

• A Purifier service bound in the container with a facade and a global clean() helper
• Named configuration profiles so different fields can use different allow-lists
• Eloquent casts (CleanHtml, CleanHtmlInput, CleanHtmlOutput) for automatic model sanitization
• Automatic Laravel package discovery and a publishable config file
• The full power of ezyang/htmlpurifier’s standards-compliant, whitelist-based cleaning

Common Use Cases

• Sanitizing WYSIWYG / rich-text editor output before storing it in the database
• Stripping XSS payloads from user comments, posts, and profile fields
• Applying different HTML allow-lists per field via named config profiles
• Automatically cleaning model attributes on set or get using Eloquent casts

Under The Hood

Architecture - The core Purifier.php class resolves configuration from Laravel’s config repository and lazily constructs an HTMLPurifier instance (caching serializer output to the filesystem for speed). PurifierServiceProvider.php binds it as a singleton, publishes the config, and registers the facade alias; src/helpers.php exposes a global clean() wrapper. The Casts/ directory adds Eloquent attribute casts that route model values through the same clean() path on input, output, or both.

Tech Stack - PHP 7.2+/8.x built on ezyang/htmlpurifier ^4.16 plus Laravel’s illuminate/config, illuminate/support, and illuminate/filesystem contracts, so it tracks Laravel 5 through 13. Dev tooling uses PHPUnit, Mockery, and graham-campbell/testbench.

Code Quality - A tests/ suite exercises cleaning behavior, config selection, and the casts against an in-memory testbench app. The package is thin by design, delegating the security-critical work to HTMLPurifier and keeping its own surface small and reviewable; PSR-4 autoloading and Laravel package-discovery metadata are declared in composer.json.

API Design - The public API is minimal and Laravel-idiomatic: Purifier::clean($html, 'profile'), the clean() helper, and cast classes cover essentially all usage. Named config profiles keep policy out of call sites, and auto-discovery means most users add nothing beyond composer require to get working defaults.