fix: address CodeRabbit review findings on PR #48

- Preserve previous state in Blaspable::withoutBlaspChecking() for nested calls
- Reject recursive pipeline driver configuration
- Guard validation rule against non-string input
- Respect except fields when middleware fields config is set
- Apply severity filter before overlap dedup in PatternDriver
- Apply severity filter before masking in RegexDriver
- Use mb_strtolower/mb_strlen in PhoneticMatcher for UTF-8 safety
- Remove unused Dictionary import from BlaspServiceProvider

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: deemonic

src/BlaspManager.php

@@ -78,6 +78,10 @@ public function createPipelineDriver(): DriverInterface
         $config = $this->app['config']->get('blasp.drivers.pipeline', []);
         $driverNames = $config['drivers'] ?? ['regex', 'phonetic'];
 
+        if (in_array('pipeline', $driverNames, true)) {
+            throw new InvalidArgumentException('Pipeline driver cannot contain itself. Remove "pipeline" from blasp.drivers.pipeline.drivers.');
+        }
+
         $resolvedDrivers = array_map(
             fn (string $name) => $this->resolveDriver($name),
             $driverNames,

src/BlaspServiceProvider.php

@@ -6,8 +6,6 @@
 use Illuminate\Support\ServiceProvider;
 use Illuminate\Support\Str;
 use Illuminate\Support\Stringable;
-use Blaspsoft\Blasp\Core\Dictionary;
-
 class BlaspServiceProvider extends ServiceProvider
 {
     public function boot(): void
@@ -53,6 +51,10 @@ public function register(): void
     protected function registerValidationRule(): void
     {
         $this->app['validator']->extend('blasp_check', function ($attribute, $value, $parameters) {
+            if (!is_string($value) || $value === '') {
+                return true;
+            }
+
             $language = $parameters[0] ?? config('blasp.language', config('blasp.default_language', 'english'));
 
             $manager = $this->app->make('blasp');

src/Blaspable.php

@@ -92,12 +92,13 @@ public function blaspResult(string $attribute): ?Result
 
     public static function withoutBlaspChecking(Closure $callback): mixed
     {
+        $previousState = static::$blaspCheckingDisabled;
         static::$blaspCheckingDisabled = true;
 
         try {
             return $callback();
         } finally {
-            static::$blaspCheckingDisabled = false;
+            static::$blaspCheckingDisabled = $previousState;
         }
     }
 }

src/Core/Matchers/PhoneticMatcher.php

@@ -14,14 +14,14 @@ public function __construct(
         private float $maxDistanceRatio = 0.6,
         private array $phoneticFalsePositives = [],
     ) {
-        $this->phoneticFalsePositives = array_map('strtolower', $this->phoneticFalsePositives);
+        $this->phoneticFalsePositives = array_map(fn($fp) => mb_strtolower($fp, 'UTF-8'), $this->phoneticFalsePositives);
         $this->buildIndex($profanities);
     }
 
     private function buildIndex(array $profanities): void
     {
         foreach ($profanities as $word) {
-            $lower = strtolower($word);
+            $lower = mb_strtolower($word, 'UTF-8');
             if (mb_strlen($lower, 'UTF-8') < $this->minWordLength) {
                 continue;
             }
@@ -62,7 +62,7 @@ public function match(string $word): ?string
 
         foreach ($this->index[$code] as $profanity) {
             $distance = levenshtein($lower, $profanity);
-            $maxLen = max(strlen($lower), strlen($profanity));
+            $maxLen = max(mb_strlen($lower, 'UTF-8'), mb_strlen($profanity, 'UTF-8'));
             $threshold = (int) ceil($this->maxDistanceRatio * $maxLen);
 
             if ($distance <= $threshold && $distance < $bestDistance) {

src/Drivers/PatternDriver.php

@@ -57,6 +57,15 @@ public function detect(string $text, Dictionary $dictionary, MaskStrategyInterfa
             }
         }
 
+        // Apply severity filter before dedup so shorter high-severity matches aren't swallowed
+        $minimumSeverity = $options['severity'] ?? null;
+        if ($minimumSeverity instanceof Severity) {
+            $matchedWords = array_values(array_filter(
+                $matchedWords,
+                fn(MatchedWord $w) => $w->severity->isAtLeast($minimumSeverity)
+            ));
+        }
+
         // Deduplicate overlapping matches (longest-first already recorded)
         usort($matchedWords, fn($a, $b) => $a->position - $b->position ?: $b->length - $a->length);
         $deduplicated = [];
@@ -69,15 +78,6 @@ public function detect(string $text, Dictionary $dictionary, MaskStrategyInterfa
         }
         $matchedWords = $deduplicated;
 
-        // Apply severity filter
-        $minimumSeverity = $options['severity'] ?? null;
-        if ($minimumSeverity instanceof Severity) {
-            $matchedWords = array_values(array_filter(
-                $matchedWords,
-                fn(MatchedWord $w) => $w->severity->isAtLeast($minimumSeverity)
-            ));
-        }
-
         // Rebuild cleanText from surviving matches (right-to-left)
         $cleanText = $text;
         $sorted = $matchedWords;

src/Drivers/RegexDriver.php

@@ -109,7 +109,7 @@ public function detect(string $text, Dictionary $dictionary, MaskStrategyInterfa
             }
         }
 
-        // Apply severity filter if set
+        // Apply severity filter before masking so low-severity matches don't suppress overlapping ones
         $minimumSeverity = $options['severity'] ?? null;
         if ($minimumSeverity instanceof Severity) {
             $matchedWords = array_values(array_filter(

src/Middleware/CheckProfanity.php

@@ -22,10 +22,10 @@ public function handle(Request $request, Closure $next, ?string $action = null,
         $fields = config('blasp.middleware.fields', ['*']);
         $except = config('blasp.middleware.except', ['password', 'email', '_token']);
 
-        $input = $request->except($except);
-
         if ($fields !== ['*']) {
-            $input = $request->only($fields);
+            $input = collect($request->only($fields))->except($except)->all();
+        } else {
+            $input = $request->except($except);
         }
 
         $textFields = $this->extractTextFields($input);