Filament•16mo ago

Xss attacks protect

In filament when i try adding script alert to text input it show me alert in page. it is dangerous. how can i protect from xss attack?

30 Replies

toeknee•16mo ago

How are you adding a script alert to a text input? Can you clarify If you are on about inputting, just use a Laravel Rule on the input to prevent adding it based on the rule.

toghrulcalalliOP•16mo ago

LeandroFerreira•16mo ago

->dehydrateStateUsing(fn (string $state): string => strip_tags($state))

->dehydrateStateUsing(fn (string $state): string => strip_tags($state))

toghrulcalalliOP•16mo ago

thank you my friend. must i do it in all fields? in rich editor i cannot strip tags(( what will i do then?

LeandroFerreira•16mo ago

if you want to apply for all textinput fields you can do something like this

return $panel
    ->bootUsing(function () {
        TextInput::configureUsing(function (TextInput $input) {
            $input->dehydrateStateUsing(fn (string $state): string => strip_tags($state));
        });
    })

return $panel
    ->bootUsing(function () {
        TextInput::configureUsing(function (TextInput $input) {
            $input->dehydrateStateUsing(fn (string $state): string => strip_tags($state));
        });
    })

or create a laravel macro. I think you can replace some tags If you want to prevent this in the rich editor

toghrulcalalliOP•16mo ago

where will i do this?

LeandroFerreira•16mo ago

by panel, AdminPanelProvider.php // or YourPanelProvider.php or AppServiceProvider.php

public function boot(): void
{
    TextInput::configureUsing(function (TextInput $input) {
        $input->dehydrateStateUsing(fn (string $state): string => strip_tags($state));
    });
}

public function boot(): void
{
    TextInput::configureUsing(function (TextInput $input) {
        $input->dehydrateStateUsing(fn (string $state): string => strip_tags($state));
    });
}

toghrulcalalliOP•16mo ago

thank you my friend you saved my time. in rich editor i must spesify spesific tags?

LeandroFerreira•16mo ago

not sure if it is the right way, but it is supposed to work

toghrulcalalliOP•16mo ago

yes i didnt find other solution

awcodes•16mo ago

We’re you getting the alert outside of filament. I tried to replicate the issue and everything was sanitized properly.

toghrulcalalliOP•16mo ago

no i am getting alert inside filament

awcodes•16mo ago

Weird. I never got the alert. Are any of the fields reactive? Or were you getting it after saving the record.

toghrulcalalliOP•16mo ago

yes reactive title field for slug

awcodes•16mo ago

Can you share the code for your form. I couldn’t replicate it with reactive either. I’m wondering if it’s an issue with your livewire version. Either way something odd is going on in your app.

awcodes•16mo ago

No alert in the demo either.

toghrulcalalliOP•16mo ago

awcodes•16mo ago

All that looks ok. So weird.

toghrulcalalliOP•16mo ago

:(((

awcodes•16mo ago

Do you have an custom casts on the relationship.? You could try upgrading filament too. You might be on a broken version. Might help too to know what version of filament and livewire you have installed. Can you run php artisan about and let us know.

toghrulcalalliOP•16mo ago

filament 3.x-dev livewire inside filament i didnt install seperately

awcodes•16mo ago

Why are you on 3x-dev

toghrulcalalliOP•16mo ago

i upgraded again shown 3x dev

awcodes•16mo ago

Are you using a repository key in your composer.json. It should only be 3.x-dev if you’re using a cloned copy locally or using vcs as a repo.

toghrulcalalliOP•16mo ago

awcodes•16mo ago

Definitely something wrong with how you installed of your seeing that as the version of it wasn’t intentional. And you updated the minimum stability to be ‘dev’? Maybe delete vendor and composer.lock and reinstall. Other than that I’m out of ideas. But something is definitely off here. And I’m not sure what. And I can’t replicate the original issue so I’m not confident it’s a Filament thing.

toghrulcalalliOP•16mo ago

i did it with app service provide dehydrate which friend said. is it wrong way?

awcodes•16mo ago

It’s not wrong to configure fields in a service provider. What’s wrong is that you have too for this use case.

toghrulcalalliOP•16mo ago

how didnt you get alert after use script in reactive text input

awcodes•16mo ago

I typed it in. Blurred the field to trigger the reactively and no alert. In another v3 app, typed it into a non reactive field and saved the form and still no alert. Basically though if you can’t replicate something in the demo app. https://demo.filamentphp.com then there’s a good chance that something is off in your app/install.

Gaming

Programming

Xss attacks protect