Quill: Quill strips out harmless html with dangerouslyPasteHTML

[christopherbauer]

I am probably misunderstanding something about the library, but all I want to do is add a span that contains some information that I can use to "tag" a user from a list. Everything is working except for pasting a span that contains the information I need to link the post to the user that is being tagged.

Steps for Reproduction

1. Visit Example Codepen Here
2. Inspect the Element
3. No HTML

Expected behavior:

1. HTML

Actual behavior:

1. No HTML

Platforms:

1. All

Version:

1.3

[christopherbauer]

I have tried to implement a "pass all html through" matcher here: Attempt to Fix *Updated

I am getting "Delta() is undefined". I used the logic from the documentation so I'm a bit confused, do I need to add a special CDN library to access Delta?

I found that deltas are implemented in a separate library, I thought it would work if I was using the main quill.js. I'll try to update the pen ASAP.

[f3ltron]

you have to import it

var Delta = Quill.import('delta');

[f3ltron]

I found this problem too when i tried to add a div that corresponding to an embed value. It suck it can be good to have two differents way to dangerouslyPasteHtml.

But what i understand about that is quill cannot properly create the ops table if we do it like this. So that's why it delete all div etc.

[jhchen]

Quill does not allow arbitrary HTML so it may change or strip markup. As stated in the docs for dangerouslyPasteHTML:

The snippet is interpreted by Clipboard matchers, which may not produce the exactly input HTML.

[christopherbauer]

@jhchen I understand that, I read the docs and stated as such clearly in the second comment in which I'm attempting to add a matcher that will allow passthrough of html. All I need is to understand why my node insert below doesn't work properly:

https://codepen.io/anon/pen/ZJmXxo

[f3ltron]

i am like him dont really understand the add matcher. I have an embed data i want to re insert when its match but its not working and get the same error as him...

Maybe more information and examples in doc could be great....

[jhchen]

Quill itself does not allow arbitrary HTML by design. It it not safe from a bug free and user experience perspective, not just a security one. Vanilla contenteditable and previous generation of rich text editors earned their notoriety because of this and part of the reason Quill was born. If you nevertheless prefer the flexibility of arbitrary HTML modifications, other editors with this support still exist.

If you accept this part then the matchers are just obliging at the paste layer what Quill's underlying data model wants which is a consistent deterministic markup. You can make deep customizations to the data model through Parchment and this guide is a good place to start but this is not just at the paste layer.

[f3ltron]

i have an answear for him. I will write it tommorrow. @jhchen can we have more efficent doc (more example, more explanation in depth) about addmatcher in doc and maybe other like video support maybe ? Maybe i can help you

[igorbuts]

While using Quill in my app I also need to add some arbitrary HTML, that is - adding ids to tags that are allowed by quill. I need this to link some items in the editor with other parts of my application.

@jhchen, is adding ids also not safe from a bug free and user experience perspective?
If not, if there any possibility that such type of arbitrary HTML as this will be allowed?

[uptownhr]

@f3ltron any possibility for that example or response?

[tungvn-vieted]

Hmm. Seems that function remove all table tags. Why the table tags is not safe?

[chadwickmeyer]

I find it extraordinary that Quill strips out valid HTML like elements table, or valid attributes like class, and that there is no way to turn off the stripping or providing our own custom white list. This makes the product completely unusable in any environment (e.g. a CMS) where users may have tabular data, or designers edit the HTML and add custom classes, etc. How is that even possible?