What a content editor preview is drawn through, as an HtmlSanitizeEx scrubber: every element and attribute a component draws — a button, a form, an svg, a figure, a dl — less what runs or reaches out.

• elements removed with what they hold: script, style, template, noscript, and the ones that load or change another document — iframe, frame, frameset, object, embed, applet, base, meta, link;
• attributes removed: every event attribute (on…), every LiveView binding (phx-…), and an address — href, src, srcset, action, formaction, poster, … — that is not http(s), mail, phone or the page's own, or, for a picture's src, srcset or poster, a data:image/… one (a kit's sample pictures travel as those); a style is read through HtmlSanitizeEx.Scrubber.CSS;
• comments removed.

A preview is drawn inert, in a shadow root, under the admin's Content Security Policy — so a form it holds submits nothing, a button presses nothing, and a style element would be refused anyway. HtmlSanitizeEx.html5/1 keeps only the elements it names, and took a button's own element away and left its label, a definition list's terms without the list: every setting of those components changed nothing in the preview.