files as $_file) { $_file = is_array($_file) ? $_file : [$_file]; foreach ($_file as $__file) { $__file = is_array($__file) ? $__file : [$__file]; foreach($__file as $file){ if ($file instanceof UploadedFile) { $this->sanitizeFile($file); } } } } return $next($request); } protected function sanitizeFile(UploadedFile $file) { $extension = $file->getClientOriginalExtension(); $contents = file_get_contents($file->getPathname()); $sanitizedContents = $this->sanitizeFileContent($contents, $extension); file_put_contents($file->getPathname(), $sanitizedContents); } protected function sanitizeFileContent(string $contents, string $extension): string { switch (strtolower($extension)) { case 'html': case 'htm': case 'svg': //case 'png': return preg_replace(['//', '/(.*?)<\/script>/is', '/<.*?on\w+=".*?"/is'], '', $contents); case 'xml': return preg_replace(['//', '//', '//s'], '', $contents); default: return $contents; } } }