Quill Delta Parser Laravel Package

Technical Evaluation

Architecture Fit

• Use Case Alignment:
  • Enhanced Rich-Text Support: The Size listener for font-size attributes (3.7.0) expands compatibility with Quill.js’s formatting modules, making it more suitable for:
    • Advanced CMS editors (e.g., styling hierarchies like headings, captions).
    • Design-focused tools (e.g., newsletters, marketing pages with precise typography).
  • Security Boundary Ownership (3.7.1): The package now owns URI scheme validation for link, image, and video attributes at the listener layer. Architecturally this is the right place — validation happens at render time, before values reach href/src — but it shifts responsibility: the package is now a partial sanitizer, not a dumb transformer.
  • Extensibility: Dedicated listeners plus the new $safeSchemes public property reinforce a modular architecture that supports policy injection per deployment (e.g., allow ftp in an internal DAM tool, deny it in a public marketing CMS).
• Laravel Synergy:
  • Continues to align with Laravel’s Blade templating and API response handling, especially for dynamic HTML generation.
  • Can be extended to validate/transform font-size values (e.g., convert px to rem for consistency).
  • New: $safeSchemes is a natural fit for a Laravel config file (config/quill.php → quill.safe_schemes) bound via a service provider, keeping policy out of application code.

Integration Feasibility

• Core Dependencies:
  • No changes to PHP/Laravel compatibility (still PHP 8.1+).
  • Lightweight additions: The Size listener and the scheme allowlist check are minimal, preserving the package’s low overhead.
  • New (3.7.1): Dependabot bumps only (symfony/process 5.4.51, phpunit 8.5.52) — dev/transitive, no runtime impact.
• Quill Delta Compatibility:
  • Explicit font-size support now covers a common Quill formatting op, reducing pre-processing needs.
  • New (3.7.1) — behavioral change, not schema change: Deltas containing URI schemes outside the allowlist now render differently (# for links, suppressed output for images/videos). Existing stored Deltas are not migrated or rewritten — the change is applied at parse/render time only.
• Output Control:
  • Generated HTML includes semantic font-size attributes, enabling CSS overrides and responsive adjustments.
  • New (3.7.1): Output for image/video with unsafe schemes is dropped entirely rather than degraded — this can silently remove media from previously working content.

Technical Risk

Key Questions

1. Use Case Specificity:
   • Will you leverage font-size for responsive typography (e.g., mobile/desktop adjustments)?
   • Do you need to normalize font-size units (e.g., convert px to em for consistency)?
2. Extensibility Needs:
   • Can you extend the Size listener to support custom CSS variables (e.g., --font-size-base)?
3. Performance Requirements:
   • How will font-size parsing impact real-time collaborative editing (e.g., Google Docs-like apps)?
4. Security:
   • Updated (3.7.1): Which URI schemes does your content legitimately need (ftp, tel, mailto, deep links, CDN-signed URLs)? This defines your $safeSchemes policy.
   • Updated: Do you render user-editable Deltas on privileged surfaces (admin views, emails, PDF exports)? Those are the highest-value XSS targets and the reason this patch is urgent.
   • New: How many existing rows/assets rely on now-blocked schemes, and what is the user-visible outcome (dead link vs. missing image)?
5. Testing:
   • Add tests for:
     • font-size parsing with invalid values (e.g., "invalid", null).
     • Nested font-size ops (e.g., nested headings).
     • New: javascript:, data:, vbscript:, mixed-case (JaVaScRiPt:), and whitespace/entity-obfuscated scheme payloads across link, image, and video.
     • New: Allowed custom scheme round-trip via $safeSchemes override.
     • New: Assert image/video suppression renders no empty <img>/<video> shell.

Integration Approach

Stack Fit

• Laravel Ecosystem:
  • Request Handling: Parse font-size in Delta payloads (e.g., from Quill.js API calls).
  • Response Handling: Inject parsed font-size into Blade templates or API responses.
  • CSS Integration: Use Laravel Mix/Tailwind to override default font-size or apply utility classes.
  • New — Scheme Policy as Config: Externalize $safeSchemes into config/quill.php and register listeners in a QuillServiceProvider so security policy is reviewable and environment-specific (strict in production, permissive in internal tools).
• Frontend Sync:
  • Quill.js: Ensure Quill is configured with the Size module:

    const quill = new Quill('#editor', {
      modules: { size: true },
      theme: 'snow'
    });
    

  • Real-Time Updates: Sync font-size changes via Laravel Echo/Pusher.
  • New: Surface blocked-media cases in the editor UI where possible — silent server-side stripping produces confusing "my image disappeared" support tickets.

Migration Path

1. Emergency Patch (3.7.1):
   • composer require nadar/quill-delta-parser:^3.7.1 and deploy. Treat as a security release, not a routine bump.
   • Run composer audit in CI and add it to the pipeline if not already present.
2. Scheme Policy Definition:
   • Inventory actual schemes in stored Deltas (query JSON columns for "link", "image", "video" keys).
   • Decide default vs. extended allowlist; only broaden where a documented need exists.

   $link = new Link();
   $link->safeSchemes = ['http', 'https', 'mailto', 'tel', 'ftp'];
   $lexer->overwriteListener(new Link(), $link);
   

3. Cache Invalidation (critical):
   • New: Any previously rendered HTML cached in Redis/file/response cache, or persisted in a rendered_html column, still contains the vulnerable markup. Purge and re-render, or backfill by re-parsing stored Deltas. Upgrading the package alone does not remediate the datastore.
4. Pilot Phase:
   • Test font-size parsing and scheme validation in a non-critical feature (e.g., blog post editor).
   • Use feature flags to toggle font-size support.
5. Incremental Rollout:
   • Update existing Delta parsers to handle font-size ops.
   • Extend custom renderers to process font-size (if needed).
6. Fallback Strategy:
   • Graceful degradation: Fallback to default font-size (e.g., 16px) if parsing fails.
   • Log warnings for malformed font-size values (e.g., "100%" → sanitize to "1rem").
   • New: Log (at warning) every neutralized URI scheme with content ID, so blocked-media regressions are measurable rather than anecdotal.

Compatibility

Sequencing

1. Patch First, Feature Second:
   • Ship 3.7.1 upgrade ahead of and independent of any font-size/Size listener work, so a security rollback can't be entangled with a feature regression.
2. Setup:
   • Install/update package: composer require nadar/quill-delta-parser:^3.7.1.
   • Verify Quill.js includes the Size module.
   • Define $safeSchemes from config.
3. Basic Integration:
   • Parse Delta with font-size:

     $html = $parser->parse($deltaWithFontSize);
     

   • Render in Blade:

     <div class="prose">{{ $html }}</div>
     

4. Enhancements:
   • Normalize font-size: Extend the parser to convert px to rem:

     $parser->extend(function ($node) {
         if ($node->getAttribute('font-size')) {
             $node->setAttribute('style', 'font-size: ' . pxToRem($node->getAttribute('font-size')) . ';');
         }
     });
     

   • Sanitize values: Reject invalid font-size (e.g., "auto", "inherit").
   • New: Layer an HTML sanitizer (e.g., mews/purifier) for style/class attributes, since 3.7.1 does not cover them.
5. Optimization:
   • Cache parsed HTML with font-size for static content — but only after the cache purge in migration step 3.
   • Add rate limiting if font-size parsing is CPU-intensive (unlikely).

Operational Impact

Maintenance

• Dependencies:
  • Monitor Quill.js updates for font-size module changes.
  • New: Track GitHub Security Advisories for this package (GHSA feed) and subscribe to release notifications; two advisories-adjacent releases in quick succession (3.7.0 → 3.7.1) indicate active security maintenance.
  • New: Custom extensions to Size/Link/Image/Video listeners must be re-verified against each patch — listener overwrites are the most likely upgrade casualty.
• Deprecation:
  • No deprecations; 3.7.1 is a secure-by-default behavior change, not a breaking API change. Treat it in release notes as breaking for content, not for code.

Support

• Debugging:
  • Log font-size parsing warnings for invalid values.
  • Use XDebug to inspect Size listener logic.
  • New: Add a distinguishable log channel/level for "scheme neutralized" events; support staff need a self-service answer to "why is my image gone?"
• Community:
  • Limited adoption of font-size listener; prioritize testing if critical.
  • New: Expect upstream documentation churn — changelog was migrated to GitHub Releases (PR #107), so any tooling parsing CHANGELOG.md internally will break.
• SLAs:
  • Define fallback behavior for parsing failures (e.g., default font-size).
  • New: Define a security-patch SLA (e.g., high-severity advisory deployed within 72 hours) and pre-approve the change path so patching isn't blocked by release governance.

Scaling

• Performance Bottlenecks:
  • Benchmark font-size parsing in large Deltas (e.g., 10K ops with nested sizes).
  • New: Scheme validation adds a per-attribute regex/comparison — measure on media-heavy documents (image-heavy newsletters), where attribute density is highest.
  • Mitigation: Use Laravel Queues for async parsing if needed.
• Horizontal Scaling:
  • Stateless listeners → scales with Laravel’s queue workers.
• Database Impact:
  • Storing HTML with font-size may increase size; compress if needed.
  • New: Anticipate a one-time re-render/backfill job that rewrites cached HTML — size this against total content volume and schedule off-peak.

Failure Modes