sanitizeMessage

Overview

Sanitize a message to prevent XSS attacks.

Markup a server sends deliberately is supported through a restrictive allowlist: basic emphasis, paragraphs, lists, and links. Everything else is removed. Text that arrives entity-encoded stays encoded and therefore displays as the literal characters it stands for.

Signature

sanitizeMessage(message)

Parameters

Name	Type	Required	Description
message	string	yes	The message to sanitize.

Returns

string

• The sanitized message.

Source

client/lib/utils/html.js:19