<turbo-stream action="append" target="posts_list"><template>    <div class="postbit" id="284348" data-post-id="284348">
  <section>
    <div class="post-wrap">


					<div class="post-header">
		        <div class="user-avatar">
		          <img alt="Morzaram" src="https://forum.elixirforum.com/user_avatar/forum.elixirforum.com/Morzaram/120/24522_2.png" width="120" height="120" />
		        </div>
					
						<div class="user-details">
		          <div class="user-name">
		            <h3>
                  Morzaram
                    <span class="op-star" title="Thread Starter">
                      <img alt="OP" class="op-star-icon" src="/assets/thread-icons/thread-icon-thread-starter-df91e872.png" />
                    </span>
                  </h3>
		          </div>
						
						</div>
					
					</div>

	        <div class="thread-main">
	            <div class="post-body" data-turbo="false">
								<p>I can’t remember. It’s been quite a while. I think it had more feature control and extensability, and doc clarity. But I can’t say any more due to time’s sake.</p> 
	            </div>

	            <div class="base-line">
	                <div class="thread-counters">
	                    <span class="thread-count count-likes js-likers-trigger" title="Likes" data-post-id="284348" data-batch-url="/posts/batch_likers">
                        0
                      </span>
                      <!-- <span class="thread-count js-solved-indicator" title="Marked as solution"></span> -->
	                </div>
	                <div class="go-to-post">
	                  <a title="Go to post" alt="Go to post" href="https://forum.elixirforum.com/t/how-to-connect-quill-with-phoenix/46004/12">Post #11</a>
	                </div>
	            </div>
              <div id="likers-container-284348" 
                   class="likers-container"
                   data-first-post="false"
                   data-batch-url="/posts/batch_likers">
                   <div class="likers-placeholder" 
                     data-likers-post-id="284348"
                     data-batch-url="/posts/batch_likers">
                  <div class="post-likers"></div>
                </div>
              </div>
	        </div>
			

    </div>

    <div class="triangle-top-right type-standard-post cat-standard-post" title="Post #11"></div>
  </section>
</div>
    <div class="postbit" id="360953" data-post-id="360953">
  <section>
    <div class="post-wrap">


					<div class="post-header">
		        <div class="user-avatar">
		          <img alt="fteschke" src="https://forum.elixirforum.com/user_avatar/forum.elixirforum.com/fteschke/120/36108_2.png" width="120" height="120" />
		        </div>
					
						<div class="user-details">
		          <div class="user-name">
		            <h3>
                  fteschke
                  </h3>
		          </div>
						
						</div>
					
					</div>

	        <div class="thread-main">
	            <div class="post-body" data-turbo="false">
								<p>This might help you to convert Quill Delta to HTML on the server instead of relying on client-generated HTML (remember to always sanitize!):</p><aside class="onebox allowlistedgeneric" data-onebox-src="https://ftes.de/articles/2025-03-16-quill-delta-to-html">
  <header class="source">
      <img src="https://ftes.de/icon.png?f6d5b12a0e02fbc7" class="site-icon" alt="" width="128" height="128">

      <a href="https://ftes.de/articles/2025-03-16-quill-delta-to-html" target="_blank" rel="noopener nofollow ugc">ftes.de</a>
  </header>

  <article class="onebox-body">
    

<h3><a href="https://ftes.de/articles/2025-03-16-quill-delta-to-html" target="_blank" rel="noopener nofollow ugc">Taming Rich Text in Elixir - Fredrik Teschke</a></h3>

  <p>Render Quill Delta on the Server</p>


  </article>

  <div class="onebox-metadata">
    
    
  </div>

  <div style="clear: both"></div>
</aside>
 
	            </div>

	            <div class="base-line">
	                <div class="thread-counters">
	                    <span class="thread-count count-likes js-likers-trigger" title="Likes" data-post-id="360953" data-batch-url="/posts/batch_likers">
                        1
                      </span>
                      <!-- <span class="thread-count js-solved-indicator" title="Marked as solution"></span> -->
	                </div>
	                <div class="go-to-post">
	                  <a title="Go to post" alt="Go to post" href="https://forum.elixirforum.com/t/how-to-connect-quill-with-phoenix/46004/13">Post #12</a>
	                </div>
	            </div>
              <div id="likers-container-360953" 
                   class="likers-container"
                   data-first-post="false"
                   data-batch-url="/posts/batch_likers">
                   <div class="likers-placeholder" 
                     data-likers-post-id="360953"
                     data-batch-url="/posts/batch_likers">
                  <div class="post-likers"></div>
                </div>
              </div>
	        </div>
			

    </div>

    <div class="triangle-top-right type-standard-post cat-standard-post" title="Post #12"></div>
  </section>
</div>
    <div class="postbit" id="360959" data-post-id="360959">
  <section>
    <div class="post-wrap">


					<div class="post-header">
		        <div class="user-avatar">
		          <img alt="olivermt" src="https://forum.elixirforum.com/user_avatar/forum.elixirforum.com/olivermt/120/2354_2.png" width="120" height="120" />
		        </div>
					
						<div class="user-details">
		          <div class="user-name">
		            <h3>
                  olivermt
                  </h3>
		          </div>
						
						</div>
					
					</div>

	        <div class="thread-main">
	            <div class="post-body" data-turbo="false">
								<p>Cant speak for the one you qouted, but I prefer tiptap because the format can be sanitized via csp headers, making it much safer against xss etc since it is quite literally impossible to create the script or attritbute nodes with csp in place.</p>
<p>Edit: some context for what I am talking about:  <a href="https://developer.mozilla.org/en-US/docs/Web/API/Trusted_Types_API" class="inline-onebox" rel="noopener nofollow ugc">Trusted Types API - Web APIs | MDN</a></p>
<p>Learning and understanding content security policy headers should be mandatory for everyone interested in rich text editing <img src="https://forum.elixirforum.com/images/emoji/apple/slight_smile.png?v=15" title=":slight_smile:" class="emoji" alt=":slight_smile:" loading="lazy" width="20" height="20"></p> 
	            </div>

	            <div class="base-line">
	                <div class="thread-counters">
	                    <span class="thread-count count-likes js-likers-trigger" title="Likes" data-post-id="360959" data-batch-url="/posts/batch_likers">
                        1
                      </span>
                      <!-- <span class="thread-count js-solved-indicator" title="Marked as solution"></span> -->
	                </div>
	                <div class="go-to-post">
	                  <a title="Go to post" alt="Go to post" href="https://forum.elixirforum.com/t/how-to-connect-quill-with-phoenix/46004/14">Post #13</a>
	                </div>
	            </div>
              <div id="likers-container-360959" 
                   class="likers-container"
                   data-first-post="false"
                   data-batch-url="/posts/batch_likers">
                   <div class="likers-placeholder" 
                     data-likers-post-id="360959"
                     data-batch-url="/posts/batch_likers">
                  <div class="post-likers"></div>
                </div>
              </div>
	        </div>
			

    </div>

    <div class="triangle-top-right type-standard-post cat-standard-post" title="Post #13"></div>
  </section>
</div>
    <div class="postbit" id="367870" data-post-id="367870">
  <section>
    <div class="post-wrap">


					<div class="post-header">
		        <div class="user-avatar">
		          <img alt="fteschke" src="https://forum.elixirforum.com/user_avatar/forum.elixirforum.com/fteschke/120/36108_2.png" width="120" height="120" />
		        </div>
					
						<div class="user-details">
		          <div class="user-name">
		            <h3>
                  fteschke
                  </h3>
		          </div>
						
						</div>
					
					</div>

	        <div class="thread-main">
	            <div class="post-body" data-turbo="false">
								<aside class="quote no-group" data-username="olivermt" data-post="14" data-topic="46004">
<div class="title">
<div class="quote-controls"></div>
<img alt="" width="24" height="24" src="https://forum.elixirforum.com/user_avatar/forum.elixirforum.com/olivermt/48/2354_2.png" class="avatar"> olivermt:</div>
<blockquote>
<p>I prefer tiptap because the format can be sanitized via csp headers, making it much safer against xss etc</p>
</blockquote>
</aside>
<p>Will that also help if I want to include the rich text in an email generated server side?</p> 
	            </div>

	            <div class="base-line">
	                <div class="thread-counters">
	                    <span class="thread-count count-likes js-likers-trigger" title="Likes" data-post-id="367870" data-batch-url="/posts/batch_likers">
                        0
                      </span>
                      <!-- <span class="thread-count js-solved-indicator" title="Marked as solution"></span> -->
	                </div>
	                <div class="go-to-post">
	                  <a title="Go to post" alt="Go to post" href="https://forum.elixirforum.com/t/how-to-connect-quill-with-phoenix/46004/15">Post #14</a>
	                </div>
	            </div>
              <div id="likers-container-367870" 
                   class="likers-container"
                   data-first-post="false"
                   data-batch-url="/posts/batch_likers">
                   <div class="likers-placeholder" 
                     data-likers-post-id="367870"
                     data-batch-url="/posts/batch_likers">
                  <div class="post-likers"></div>
                </div>
              </div>
	        </div>
			

    </div>

    <div class="triangle-top-right type-standard-post cat-standard-post" title="Post #14"></div>
  </section>
</div>
    <div class="postbit" id="367875" data-post-id="367875">
  <section>
    <div class="post-wrap">


					<div class="post-header">
		        <div class="user-avatar">
		          <img alt="olivermt" src="https://forum.elixirforum.com/user_avatar/forum.elixirforum.com/olivermt/120/2354_2.png" width="120" height="120" />
		        </div>
					
						<div class="user-details">
		          <div class="user-name">
		            <h3>
                  olivermt
                  </h3>
		          </div>
						
						</div>
					
					</div>

	        <div class="thread-main">
	            <div class="post-body" data-turbo="false">
								<p>No I don’t think so, the security aspects rely on CSP headers that allow/disallow what can be added to an html node. Essentially its a whitelist of what html nodes javascript is allowed to insert.</p> 
	            </div>

	            <div class="base-line">
	                <div class="thread-counters">
	                    <span class="thread-count count-likes js-likers-trigger" title="Likes" data-post-id="367875" data-batch-url="/posts/batch_likers">
                        1
                      </span>
                      <!-- <span class="thread-count js-solved-indicator" title="Marked as solution"></span> -->
	                </div>
	                <div class="go-to-post">
	                  <a title="Go to post" alt="Go to post" href="https://forum.elixirforum.com/t/how-to-connect-quill-with-phoenix/46004/16">Post #15</a>
	                </div>
	            </div>
              <div id="likers-container-367875" 
                   class="likers-container"
                   data-first-post="false"
                   data-batch-url="/posts/batch_likers">
                   <div class="likers-placeholder" 
                     data-likers-post-id="367875"
                     data-batch-url="/posts/batch_likers">
                  <div class="post-likers"></div>
                </div>
              </div>
	        </div>
			

    </div>

    <div class="triangle-top-right type-last-post cat-last-post" title="Last post!"></div>
  </section>
</div>
</template></turbo-stream><turbo-stream action="replace" target="load-more-container"><template><div id="load-more-container" class="load-more-container">
    <span class="all-loaded">— All posts loaded —</span>
</div></template></turbo-stream>