diff --git a/apps/api/src/app/message-template/shared/sanitizer.service.spec.ts b/apps/api/src/app/message-template/shared/sanitizer.service.spec.ts
index e4b7b9d6a4f..d9e2bde87fc 100644
--- a/apps/api/src/app/message-template/shared/sanitizer.service.spec.ts
+++ b/apps/api/src/app/message-template/shared/sanitizer.service.spec.ts
@@ -60,4 +60,16 @@ describe('HTML Sanitizer', function () {
expect(result[0].content).to.equal('
Red Text
');
});
+
+ it('should NOT sanitize img tags', function () {
+ const result = sanitizeMessageContent([
+ {
+ type: EmailBlockTypeEnum.TEXT,
+ content: '
',
+ url: '',
+ },
+ ]);
+
+ expect(result[0].content).to.equal('
');
+ });
});
diff --git a/apps/api/src/app/message-template/shared/sanitizer.service.ts b/apps/api/src/app/message-template/shared/sanitizer.service.ts
index ea2651d5798..a3bafe14aa8 100644
--- a/apps/api/src/app/message-template/shared/sanitizer.service.ts
+++ b/apps/api/src/app/message-template/shared/sanitizer.service.ts
@@ -10,13 +10,14 @@ const sanitizeOptions: sanitize.IOptions = {
/**
* Additional tags to allow.
*/
- allowedTags: sanitize.defaults.allowedTags.concat(['style']),
+ allowedTags: sanitize.defaults.allowedTags.concat(['style', 'img']),
allowedAttributes: {
...sanitize.defaults.allowedAttributes,
/**
* Additional attributes to allow on all tags.
*/
'*': ['style'],
+ img: ['src', 'srcset', 'alt', 'title', 'width', 'height', 'loading'],
},
/**
* Required to disable console warnings when allowing style tags.