- Edited
Hello Flarum people!
I'm the author of s9e\TextFormatter, a text formatting library that supports a bunch of different markup as plugins. It is uniquely geared towards forum software in that it's designed to handle input from untrusted sources, while being customisable and performant. Two years ago I contacted @Franz about FluxBB 2 and I'd love to extend the same offer to @Toby and Flarum.
Flarum's default markup is Markdown. The library supports Markdown-like markup (here's a demo) but I would consider looking into using league/commonmark's parser as a plugin if there was a need for it.
The main differences between s9e\TextFormatter and other libraries are:
Most (every?) other libraries are designed transform plain text to HTML. That means you either completely reparse every post on every page and take the performance hit, or you have to cache the HTML and pay for it with increased storage requirements while making it harder to customise the output without nuking the cache.
s9e\TextFormatter separates parsing from rendering, letting it do 90% of the work at posting time rather than when the text is displayed. Here's how it works.
Every part of it is meant to handle malicious content. Checks and limits are baked into every component. For example:
- The BBCodes plugin can be used to create custom BBCodes but it won't allow a custom BBCodes to use raw user input inside of an
onclick
attribute. - The HTML plugin can be used to allow a whitelisted subset of HTML to be used but again, you cannot accidentally enable harmful markup such as ``.
- URLs used in links and/or images can support a whitelist or a blacklist of hosts. Allowed URL schemes are configurable and won't allow
javascript:
pseudo-URLs. - There are default limits to the amount of markup that can be used. For instance, a user cannot post a million of emotes or nest a hundred blockquotes inside of each other unless you choose to set those limits that high.
- The BBCodes plugin can be used to create custom BBCodes but it won't allow a custom BBCodes to use raw user input inside of an
It supports custom markup that's definable by the user. I'm not just talking about PHP extensions. For users who want BBCodes, custom BBCodes can be created using the same syntax as phpBB. (phpBB 3.2 uses s9e\TextFormatter by default) For others, safe PCRE-style replacements can be defined.
It's got a JavaScript port. I don't know how relevant this is for you but since Flarum uses JavaScript heavily it may be of interest. The parsing and rendering part (not the configuration) can be run in a browser. Here's a couple of demos: BBCodes / Markdown.
TL;DR
I'd love it if you chose s9e\TextFormatter for your text formatting needs. phpBB 3.2 uses it. Here's how it works. Here's a simple example of how to use it. Hey, there's a JavaScript demo too! Hit me up.