From 9ed403aff2882ac64b65160836eff9c11f3a5178 Mon Sep 17 00:00:00 2001
From: Nevo David <me@nevos.io>
Date: Mon, 21 Jul 2025 17:51:47 +0700
Subject: [PATCH] feat: safer replacement to avoid <Script /> injections

---
 libraries/helpers/src/utils/strip.html.validation.ts | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/libraries/helpers/src/utils/strip.html.validation.ts b/libraries/helpers/src/utils/strip.html.validation.ts
index 78c9a7b6..1843f9f0 100644
--- a/libraries/helpers/src/utils/strip.html.validation.ts
+++ b/libraries/helpers/src/utils/strip.html.validation.ts
@@ -138,7 +138,7 @@ export const stripHtmlValidation = (
   none = false
 ): string => {
   if (type === 'html') {
-    return value;
+    return striptags(value, ['ul', 'ol', 'li', 'h1', 'h2', 'h3', 'p', 'strong', 'u']);
   }
 
   if (type === 'markdown') {
@@ -178,7 +178,6 @@ export const convertLinkedinMention = (value: string) => {
   return value.replace(
     /<span.+?data-linkedin-id="(.+?)".+?>(.+?)<\/span>/gi,
     (match, id, name) => {
-      console.log(id, name);
       return `@[${name.replace('@', '')}](${id})`;
     }
   );