diff --git a/src/Rules/XssRule.php b/src/Rules/XssRule.php index 66dc3ca..bd0f345 100644 --- a/src/Rules/XssRule.php +++ b/src/Rules/XssRule.php @@ -493,6 +493,11 @@ class XssRule extends BaseRule '/^\s*action\s*\(/', // action() helper '/^\s*mix\s*\(/', // mix() helper (Laravel Mix) '/^\s*vite\s*\(/', // vite() helper (Vite) + // nl2br with e() - common safe pattern for displaying user text with line breaks + // e() escapes HTML first, then nl2br() adds
tags + '/^\s*nl2br\s*\(\s*e\s*\(/', // nl2br(e($var)) + '/^\s*nl2br\s*\(\s*htmlspecialchars\s*\(/', // nl2br(htmlspecialchars($var)) + '/^\s*nl2br\s*\(\s*htmlentities\s*\(/', // nl2br(htmlentities($var)) ]; foreach ($safePatterns as $pattern) {