Filament•11mo ago

Xss attacks protect

In filament when i try adding script alert to text input it show me alert in page. it is dangerous. how can i protect from xss attack?

30 Replies

toeknee•11mo ago

How are you adding a script alert to a text input? Can you clarify If you are on about inputting, just use a Laravel Rule on the input to prevent adding it based on the rule.

toghrulcalalli•11mo ago

LeandroFerreira•11mo ago

->dehydrateStateUsing(fn (string $state): string => strip_tags($state))

->dehydrateStateUsing(fn (string $state): string => strip_tags($state))

toghrulcalalli•11mo ago

thank you my friend. must i do it in all fields? in rich editor i cannot strip tags(( what will i do then?

LeandroFerreira•11mo ago

if you want to apply for all textinput fields you can do something like this

return $panel
    ->bootUsing(function () {
        TextInput::configureUsing(function (TextInput $input) {
            $input->dehydrateStateUsing(fn (string $state): string => strip_tags($state));
        });
    })

return $panel
    ->bootUsing(function () {
        TextInput::configureUsing(function (TextInput $input) {
            $input->dehydrateStateUsing(fn (string $state): string => strip_tags($state));
        });
    })

or create a laravel macro. I think you can replace some tags If you want to prevent this in the rich editor

toghrulcalalli•11mo ago

where will i do this?

LeandroFerreira•11mo ago

by panel, AdminPanelProvider.php // or YourPanelProvider.php or AppServiceProvider.php

public function boot(): void
{
    TextInput::configureUsing(function (TextInput $input) {
        $input->dehydrateStateUsing(fn (string $state): string => strip_tags($state));
    });
}

public function boot(): void
{
    TextInput::configureUsing(function (TextInput $input) {
        $input->dehydrateStateUsing(fn (string $state): string => strip_tags($state));
    });
}

toghrulcalalli•11mo ago

thank you my friend you saved my time. in rich editor i must spesify spesific tags?

LeandroFerreira•11mo ago

not sure if it is the right way, but it is supposed to work

toghrulcalalli•11mo ago

yes i didnt find other solution

awcodes•11mo ago

We’re you getting the alert outside of filament. I tried to replicate the issue and everything was sanitized properly.

toghrulcalalli•11mo ago

no i am getting alert inside filament

awcodes•11mo ago

Weird. I never got the alert. Are any of the fields reactive? Or were you getting it after saving the record.

toghrulcalalli•11mo ago

yes reactive title field for slug

awcodes•11mo ago

Can you share the code for your form. I couldn’t replicate it with reactive either. I’m wondering if it’s an issue with your livewire version. Either way something odd is going on in your app.

awcodes•11mo ago

No alert in the demo either.

toghrulcalalli•11mo ago

awcodes•11mo ago

All that looks ok. So weird.

toghrulcalalli•11mo ago

:(((

awcodes•11mo ago

Do you have an custom casts on the relationship.? You could try upgrading filament too. You might be on a broken version. Might help too to know what version of filament and livewire you have installed. Can you run php artisan about and let us know.

toghrulcalalli•11mo ago

filament 3.x-dev livewire inside filament i didnt install seperately

awcodes•11mo ago

Why are you on 3x-dev

toghrulcalalli•11mo ago

i upgraded again shown 3x dev

awcodes•11mo ago

Are you using a repository key in your composer.json. It should only be 3.x-dev if you’re using a cloned copy locally or using vcs as a repo.

toghrulcalalli•11mo ago

awcodes•11mo ago

Definitely something wrong with how you installed of your seeing that as the version of it wasn’t intentional. And you updated the minimum stability to be ‘dev’? Maybe delete vendor and composer.lock and reinstall. Other than that I’m out of ideas. But something is definitely off here. And I’m not sure what. And I can’t replicate the original issue so I’m not confident it’s a Filament thing.

toghrulcalalli•11mo ago

i did it with app service provide dehydrate which friend said. is it wrong way?

awcodes•11mo ago

It’s not wrong to configure fields in a service provider. What’s wrong is that you have too for this use case.

toghrulcalalli•11mo ago

how didnt you get alert after use script in reactive text input

awcodes•11mo ago

I typed it in. Blurred the field to trigger the reactively and no alert. In another v3 app, typed it into a non reactive field and saved the form and still no alert. Basically though if you can’t replicate something in the demo app. https://demo.filamentphp.com then there’s a good chance that something is off in your app/install.

Gaming

Programming

Xss attacks protect