--- title: Why Carve markup Changes How You Author Rich Text in... description: shopware-carve is a Shopware 6 plugin that introduces Carve, a plain-text markup language, as a single authoring source for rich text across multiple surfaces... canonical: https://daily.dev/posts/why-carve-markup-changes-how-you-author-rich-text-in-shopware-6-dereuromark-tvnkoxeqe twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Why Carve markup Changes How You Author Rich Text in Shopware 6 – DerEuroMark | daily.dev og:description: shopware-carve is a Shopware 6 plugin that introduces Carve, a plain-text markup language, as a single authoring source for rich text across multiple surfaces... og:url: https://daily.dev/posts/why-carve-markup-changes-how-you-author-rich-text-in-shopware-6-dereuromark-tvnkoxeqe og:image: https://api.daily.dev/og/posts/TvNKOxEQe.png og:image:alt: Why Carve markup Changes How You Author Rich Text in Shopware 6 – DerEuroMark og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Why Carve markup Changes How You Author Rich Text in Shopware 6 – DerEuroMark **[DerEuroMark](https://daily.dev/sources/dereuromark)** · 9 min read · 1 upvotes · 1 comments ## Summary shopware-carve is a Shopware 6 plugin that introduces Carve, a plain-text markup language, as a single authoring source for rich text across multiple surfaces — product pages, category listings, transactional emails, CMS blocks, and more. Instead of pasting raw HTML or relying on inconsistent WYSIWYG editors, authors write in Carve and the plugin renders safe, semantic HTML everywhere. Security is built into the renderer: raw HTML passthrough is off by default, content profiles (minimal, comment, article) restrict what untrusted users can render, and disallowed constructs degrade to inert text rather than executing. PHP and JS renderers share a cross-implementation test corpus ensuring byte-identical output between the admin live preview and the storefront. The plugin also supports inline commerce entities like :product[SKU], Twig filters for HTML/plain-text/Markdown output, and a CLI for rendering .crv files. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How does shopware-carve prevent XSS when rendering user-authored rich text in Shopware 6? Shopware-carve hardens output at the renderer level rather than relying on a separate sanitizer pass, and raw HTML passthrough is off by default. Content profiles (minimal, comment, article, none) clamp what elements are renderable for a given field; anything a profile disallows degrades to inert text instead of throwing, so a pasted script tag in a product review returns as harmless text, never execution. _Developers hardening rich text input against XSS can track approaches like this one on daily.dev._ ### How do I get a live product link with resolved price and name inside authored rich text content in Shopware 6? Use the inline Carve syntax :product[SKU] inside a carve-authored field or Twig template rendered with the |carve or |carve_ctx filter. It resolves to a live product link with name and price at render time; the carve_ctx variant should be used whenever a product reference might appear, since it passes the sales-channel context so links resolve correctly. _Shopware developers wiring live commerce data into content can follow implementations like this on daily.dev._ ### What is the difference between the minimal, comment, article, and none content profiles in shopware-carve? These profiles control how much markup untrusted input can render. Minimal allows only inline formatting plus paragraphs and lists, suited for chat or micro-posts. Comment adds lists, quotes, and code but blocks headings, images, tables, and raw HTML. Article allows everything except raw HTML, for trusted blog authors. None applies no restriction and is the default for trusted admin content. _Teams choosing safe defaults for user-generated content can compare options like these on daily.dev._ ## Community discussion Top comments from developers on daily.dev. **@markojr** · 0 upvotes > carve solves the problem i have with tables in markdown ## Similar posts on daily.dev - [Twenty years of Markdown hindsight, in one markup language: Carve – DerEuroMark](https://daily.dev/posts/twenty-years-of-markdown-hindsight-in-one-markup-language-carve-dereuromark-dlkda0ys5) · DerEuroMark · 0 upvotes · 0 comments - [From Markdown to Carve – DerEuroMark](https://daily.dev/posts/from-markdown-to-carve-dereuromark-xwphzkh3u) · DerEuroMark · 0 upvotes · 0 comments - [Sidecar Brings Statamic's Control Panel to Your Existing Markdown Sites](https://daily.dev/posts/sidecar-brings-statamic-s-control-panel-to-your-existing-markdown-sites-9k77v2dly) · Laravel News · 1 upvotes · 0 comments - [Blazor Rich Text Editor Just Got Better with Markdown and Secure Exports](https://daily.dev/posts/blazor-rich-text-editor-just-got-better-with-markdown-and-secure-exports-3aevbbtzn) · Syncfusion · 0 upvotes · 0 comments --- Tags: [#php](https://daily.dev/tags/php) [View this post on daily.dev](https://daily.dev/posts/why-carve-markup-changes-how-you-author-rich-text-in-shopware-6-dereuromark-tvnkoxeqe) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Why Carve markup Changes How You Author Rich Text in Shopware 6 – DerEuroMark","url":"https://daily.dev/posts/why-carve-markup-changes-how-you-author-rich-text-in-shopware-6-dereuromark-tvnkoxeqe","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/why-carve-markup-changes-how-you-author-rich-text-in-shopware-6-dereuromark-tvnkoxeqe"},"datePublished":"2026-07-17T18:18:08.925Z","dateModified":"2026-09-14T06:00:43.701Z","description":"shopware-carve is a Shopware 6 plugin that introduces Carve, a plain-text markup language, as a single authoring source for rich text across multiple surfaces...","image":"https://media.daily.dev/image/upload/s--qPvKM23u--/f_auto/v1722860399/public/Placeholder%2009","thumbnailUrl":"https://media.daily.dev/image/upload/s--qPvKM23u--/f_auto/v1722860399/public/Placeholder%2009","isAccessibleForFree":true,"articleSection":"DerEuroMark","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"DerEuroMark","logo":"https://media.daily.dev/image/upload/s--OwbYUam1--/f_auto,q_auto/v1772962015/logos/dereuromark","url":"https://daily.dev/sources/dereuromark"},"commentCount":1,"discussionUrl":"https://daily.dev/posts/why-carve-markup-changes-how-you-author-rich-text-in-shopware-6-dereuromark-tvnkoxeqe","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":1}],"keywords":"php","timeRequired":"PT9M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"DerEuroMark","item":"https://daily.dev/sources/dereuromark"},{"@type":"ListItem","position":3,"name":"Why Carve markup Changes How You Author Rich Text in Shopware 6 – DerEuroMark"}]} {"@context":"https://schema.org","@type":"WebPage","@id":"https://daily.dev/posts/why-carve-markup-changes-how-you-author-rich-text-in-shopware-6-dereuromark-tvnkoxeqe","comment":[{"@type":"Comment","text":"carve solves the problem i have with tables in markdown","datePublished":"2026-07-20T02:23:52.569Z","url":"https://daily.dev/posts/TvNKOxEQe#c-8BfmQhxPn","author":{"@type":"Person","name":"Marko Jozic-Reyes","url":"https://daily.dev/markojr","image":"https://media.daily.dev/image/upload/s--TvIfWcng--/f_auto/v1769558803/avatars/avatar_x9cfuU5ai02W3BPEbroGK?_a=BAMAMiiu0"}}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/why-carve-markup-changes-how-you-author-rich-text-in-shopware-6-dereuromark-tvnkoxeqe#faq","mainEntity":[{"@type":"Question","name":"How does shopware-carve prevent XSS when rendering user-authored rich text in Shopware 6?","acceptedAnswer":{"@type":"Answer","text":"Shopware-carve hardens output at the renderer level rather than relying on a separate sanitizer pass, and raw HTML passthrough is off by default. Content profiles (minimal, comment, article, none) clamp what elements are renderable for a given field; anything a profile disallows degrades to inert text instead of throwing, so a pasted script tag in a product review returns as harmless text, never execution. Developers hardening rich text input against XSS can track approaches like this one on daily.dev."}},{"@type":"Question","name":"How do I get a live product link with resolved price and name inside authored rich text content in Shopware 6?","acceptedAnswer":{"@type":"Answer","text":"Use the inline Carve syntax :product[SKU] inside a carve-authored field or Twig template rendered with the |carve or |carve_ctx filter. It resolves to a live product link with name and price at render time; the carve_ctx variant should be used whenever a product reference might appear, since it passes the sales-channel context so links resolve correctly. Shopware developers wiring live commerce data into content can follow implementations like this on daily.dev."}},{"@type":"Question","name":"What is the difference between the minimal, comment, article, and none content profiles in shopware-carve?","acceptedAnswer":{"@type":"Answer","text":"These profiles control how much markup untrusted input can render. Minimal allows only inline formatting plus paragraphs and lists, suited for chat or micro-posts. Comment adds lists, quotes, and code but blocks headings, images, tables, and raw HTML. Article allows everything except raw HTML, for trusted blog authors. None applies no restriction and is the default for trusted admin content. Teams choosing safe defaults for user-generated content can compare options like these on daily.dev."}}]} ```