Use sanitizeHtml

cardstack · Jan 17, 2025 · 43de05a · 43de05a
1 parent e11a312
commit 43de05a
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/packages/host/app/lib/matrix-classes/message-builder.ts b/packages/host/app/lib/matrix-classes/message-builder.ts
@@ -4,7 +4,7 @@ import { getOwner, setOwner } from '@ember/owner';
 
 import { inject as service } from '@ember/service';
 
-import { LooseSingleCardDocument } from '@cardstack/runtime-common';
+import { LooseSingleCardDocument, sanitizeHtml } from '@cardstack/runtime-common';
 
 import {
   APP_BOXEL_COMMAND_MSGTYPE,
@@ -190,5 +190,5 @@ export function buildMessageCommand({
 }
 
 export function formattedMessageForCommand(formattedBody: string) {
-  return `<p data-test-command-message class="command-message">${formattedBody}</p>`;
+  return `<p data-test-command-message class="command-message">${sanitizeHtml(formattedBody)}</p>`;
 }