Quill Delta Parser Laravel Package

Product Decisions This Supports

• Security Remediation / Risk Reduction: 3.7.1 fixes a stored XSS vulnerability (GHSA-q7wv-vg5w-462j) in which URI schemes from Quill delta attributes (link, image, video) were written into rendered href/src attributes without validation. Unsafe schemes (e.g. javascript:) are now neutralized—links resolve to #, images and videos are not rendered. This converts an open security finding into a routine dependency bump, and removes the need to build sanitization in our own application layer.
• Enhanced Rich Text Styling in PHP Applications: Continues native support for font-size adjustments via Quill.js, enabling finer-grained typography controls (branding, documentation, editorial tools) without CSS post-processing for dynamic font sizing.
• Content Localization & Accessibility: Supports responsive typography (accessibility compliance, multi-language content where font scaling matters).
• Build vs. Buy: Eliminates the need to hand-roll a sanitizer or extend the parser for font-size attributes. The security fix is now maintained upstream, which materially strengthens the "buy" case—URL sanitization is exactly the kind of code we should not be maintaining ourselves.
• Roadmap for Extensibility: The fix introduces a configurable allowlist ($safeSchemes per listener), so custom Quill modules and non-standard schemes remain supported without forking—while defaulting to safe behavior.
• Compliance & Security: Remains MIT-licensed and actively maintained (Dec 2025). Note the patch is also backported to the 3.5.x line, so teams on older branches are not forced into a minor upgrade. Not a "no breaking changes" release in the strictest sense: applications that deliberately rendered custom URI schemes (e.g. ftp://, tel: variants, internal deep links) will see those outputs change until the allowlist is extended.

When to Consider This Package

• Use Cases:
  • Your app requires font-size controls in Quill.js (marketing sites, design tools, documentation platforms where typography precision matters).
  • You need to store/process Quill Deltas with font-size attributes in a PHP backend (e.g. Laravel) and render them to HTML with dynamic styling.
  • User-generated or untrusted rich text is rendered server-side—the strongest adoption signal, since 3.7.1 closes a stored XSS vector that would otherwise become our responsibility.
  • Custom Quill modules for typography or styling are in scope (design-system integrations).
• Upgrade Guidance:
  • Treat 3.7.1 as a required minimum version for any surface rendering untrusted deltas.
  • Audit for reliance on non-default URI schemes and explicitly configure $safeSchemes before upgrading to avoid silent output changes:

    $link = new Link();
    $link->safeSchemes = ['http', 'https', 'mailto', 'tel', 'ftp'];
    $lexer->overwriteListener(new Link(), $link);
    

  • Note the symfony/process and phpunit/phpunit bumps are dev/tooling only—no runtime dependency risk.
• Look Elsewhere If:
  • You're using TinyMCE, CKEditor, or another WYSIWYG editor (incompatible Delta format).
  • Your stack is non-PHP (Node.js, Python) or requires serverless parsing.
  • You need real-time collaboration (Google Docs-like)—this is a parsing library, not a sync tool.
  • Your use case demands highly customized HTML output beyond Quill's defaults and requires heavy extension.
  • You cannot upgrade off a pre-3.5.1 version and cannot apply the backport—in that case, XSS exposure is on you and adoption should be reconsidered.

How to Pitch It (Stakeholders)

For Executives: "A security patch landed in our Quill delta parser: 3.7.1 fixes a stored XSS vulnerability where malicious link, image, or video URLs (e.g. javascript: payloads) could execute in users' browsers when rendered from rich-text content. The fix is upstream, backward-compatible for default configurations, and available as a low-risk patch—including a backport to the 3.5.x line. For [Product X], this closes a security gap in any user-generated content surface (comments, CMS pages, profiles) without custom engineering, avoiding an estimated 1–2 months of build and ongoing maintenance for an in-house sanitizer, and removing a likely finding from our next security review. Action: schedule the upgrade this sprint and confirm no workflows depend on custom URL schemes."

For Engineering: *"3.7.1 is a security release (GHSA-q7wv-vg5w-462j). URI schemes from delta attributes (link, image, video) are now validated against an allowlist before being written into rendered href/src. Unsafe schemes are neutralized: links render href="#", images/videos are dropped. Key implications:

• Behavior change to watch: the default allowlist is conservative. If we rely on custom schemes (ftp://, tel:, slack://, internal deep links), extend per-listener before deploying:

  $link = new Link();
  $link->safeSchemes = ['http', 'https', 'mailto', 'tel', 'ftp'];
  $lexer->overwriteListener(new Link(), $link);
  

• Audit scope: grep fixtures/tests and any golden-file HTML snapshots for now-neutralized schemes; expect snapshot diffs.
• Backport available: the same fix shipped to the 3.5.x line, so legacy services aren't blocked on a minor upgrade—but we should converge on 3.7.1.
• Performance: no meaningful change—validation happens inside the existing Delta parsing pipeline.
• Not included: symfony/process and phpunit/phpunit bumps are dev-only; no runtime surface. Changelog also migrated to GitHub Releases—update our internal release-tracking links. Recommend treating 3.7.1 as the minimum pin for all services rendering untrusted deltas, and adopting the font-size support from 3.7.0 for [Feature Y] (CMS typography controls) in the same upgrade."