How to sanitize all variables in a template?

[paymog]

I have the following code:

        await sendEmail({
          to: user.user.email,
          subject: `Subgraph ${name}/${subgraph_version} synced`,
          html: `<p>Your subgraph ${name}/${subgraph_version} in project ${projectName} has finished syncing!</p>`,
        });

What's the best way to sanitize each of the variables used in the string template? Ideally I want to ensure that these variables, like name and subgraph_version don't contain any html at all.

One idea I have to wrap each ${} with the sanitizer but I'm not sure the right config to use to sanitize out all html. Is that possible?

[BoDonkey]

Hi @paymog,
Just pass each of the variables in with allowedTags: false. Is the problem that you can't sanitize before the sendEmail() call?

[paymog]

ah gotcha! yeah I want to sanitize each variable because the emails might be fairly complex and I think would be easier to sanitize the variables than to figure out all the tags of each various email I might send.

[boutell]

sanitize-html seems unnecessary if you just want to have tags in your own string, like your paragraphs, but no tags in the user input. In that case, just escape the < & and > characters in the usual way with HTML entities.

…

On Mon, Aug 28, 2023 at 8:29 AM Paymahn Moghadasian < ***@***.***> wrote: ah gotcha! yeah I want to sanitize each variable because the emails might be fairly complex and I think would be easier to sanitize the variables than to figure out all the tags of each various email I might send. — Reply to this email directly, view it on GitHub <#631 (reply in thread)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAAH27NODV2GYYKEBLCJ6QLXXSFMJANCNFSM6AAAAAA37K733Q> . You are receiving this because you are subscribed to this thread.Message ID: <apostrophecms/sanitize-html/repo-discussions/631/comments/6841992@ github.com>

-- THOMAS BOUTELL | CHIEF TECHNOLOGY OFFICER APOSTROPHECMS | apostrophecms.com | he/him/his