Add deny-list controls for restricted content types

[zoten]

Hi! Thanks for the amazing work, I was searching for this since a long time!

I had a need related to the markdown editor and I thought it would be nice to propose it as a possible feature.

Problem

leaf_editor had no way to restrict which content types a user could insert or which editing modes were accessible. In contexts where rich content is not appropriate (e.g. I was working on a simple public user profile) there was no option to prevent users from embedding links, images, video, or switching to HTML/markdown editing mode. Any HTML produced by the editor also had no server-side content filtering, creating a gap between what the UI allowed and what could be stored.

Proposal

Introduce a deny assign (a list of atoms for now) that opts out of specific capabilities:

• :links: hides the link toolbar button, blocks Ctrl/Cmd+K shortcut, strips tags from pasted HTML and from all :leaf_changed payloads
• :images: hides image controls, strips tags from paste and output
• :video: hides the insert-video button
• :markdown_mode: hides and disables the Markdown tab
• :html_mode: hides and disables the HTML tab

Restrictions are enforced at both layers: server-side (sanitization applied before every :leaf_changed notification and on set_content) and client-side (toolbar visibility, keyboard shortcut guards, paste-time DOM stripping). The server layer is the security boundary; the client layer is UX only.

Security note

This change narrows the attack surface for stored-XSS when the editor is used in contexts where link/image embedding is undesirable. It does not replace a full allowlist HTML sanitizer at the domain/persistence layer, which is still recommended before storing or rendering html payloads outside the editor.

PR

I'm opening a draft PR with the implementation of this proposal in case it may be of interest 🙏 of course, open to discuss any other view of this feature!

[alexdont]

Hey @zoten — thanks for this, the issue write-up and the PR are both really clear, and I appreciate the security disclaimer.

A couple things before this can land:

Rebase on main — 0.2.7 and 0.2.9 touched some of the same areas:

• update/2 now preserves user-toggled :mode across re-renders
• The render template has new loading/skeleton wrappers
  (data-leaf-mount-state, data-leaf-loading, data-leaf-content)
• The markdown/html textareas got phx-update="ignore"

Most of your hunks should reapply mechanically. The interesting overlaps (especially around update/2 and the content_changed / html_content_changed handlers) are worth a quick discussion in-thread once the rebase is up.

Small fixes:

1. Add a short moduledoc note echoing your security disclaimer — that the regex sanitization is a UX layer and consumers should still allow-list at the persistence boundary.
2. In the :set_content action, sanitize the markdown content too — right now :visual_html gets sanitized but :content keeps the raw markdown, so they briefly diverge until the next user edit.
3. The new assign(:visual_html, …) in html_content_changed is a real improvement, but slightly out of scope for "deny" — could you split that into its own commit so the deny PR stays focused?

If you'd rather not do the rebase yourself, just say the word and I'll take a swing at it on a branch off your fork — don't want to redo your work uncredited.

Thanks again!

[zoten]

Thanks! This is an awesome answer and I agree with all your points.
I started the work on the draft PR, but it will take some time to be able to triple check it.

If interesting, I already isolated point 3 in commit e9eb6c so you can safely cherry-pick it if interesting.

I will keep you posted here on the testing, feel free to peek and point out anything you may find unsound!

Thanks agains 🙏

[alexdont]

I can see the merge request is ready to be merged but the PR is still in draft mode, or is there still something you are working on?

[zoten]

Hi @alexdont ! Sorry, I meant I needed some more time to test it manually! I rebased against your latest commits, feel free to take a look! 🙏