diff --git a/apps/api/src/app/message-template/shared/sanitizer.service.spec.ts b/apps/api/src/app/message-template/shared/sanitizer.service.spec.ts index e4b7b9d6a4f..d9e2bde87fc 100644 --- a/apps/api/src/app/message-template/shared/sanitizer.service.spec.ts +++ b/apps/api/src/app/message-template/shared/sanitizer.service.spec.ts @@ -60,4 +60,16 @@ describe('HTML Sanitizer', function () { expect(result[0].content).to.equal('

Red Text

'); }); + + it('should NOT sanitize img tags', function () { + const result = sanitizeMessageContent([ + { + type: EmailBlockTypeEnum.TEXT, + content: 'Example Image', + url: '', + }, + ]); + + expect(result[0].content).to.equal('Example Image'); + }); }); diff --git a/apps/api/src/app/message-template/shared/sanitizer.service.ts b/apps/api/src/app/message-template/shared/sanitizer.service.ts index ea2651d5798..a3bafe14aa8 100644 --- a/apps/api/src/app/message-template/shared/sanitizer.service.ts +++ b/apps/api/src/app/message-template/shared/sanitizer.service.ts @@ -10,13 +10,14 @@ const sanitizeOptions: sanitize.IOptions = { /** * Additional tags to allow. */ - allowedTags: sanitize.defaults.allowedTags.concat(['style']), + allowedTags: sanitize.defaults.allowedTags.concat(['style', 'img']), allowedAttributes: { ...sanitize.defaults.allowedAttributes, /** * Additional attributes to allow on all tags. */ '*': ['style'], + img: ['src', 'srcset', 'alt', 'title', 'width', 'height', 'loading'], }, /** * Required to disable console warnings when allowing style tags.