notification.content does not get sanitised on client

[DavideArgellati]

Hi we are trying to prevent xss stored in the notifications, we use the react NotificationList component, in the docs it says the NotificationComponent does prevent Xss but we still see html being rendered, eg. if we store a click here element it will render the button with the onclick event.
Any suggestion how to prevent this? do we need to use a custom component ?

[smeijer]

Hi @DavideArgellati ,

As the notification content comes from a safe source, namely your server, we do not sanitise the notification.content in our react sdk. We simply render the HTML that you've sent to us. If we were to sanitise, you'd lose the functionality of adding javascript code to your notifications.

In the past, that has been different, but we believe that the flexibility to add javascript - from a controlled source - out-weights the benefit of sanitising every message. If you need to sanitise the messages because they're user generated, then you'd need to do this on your side, preferably on your server at the moment you create the notification.

Alternatively, you can provide a custom NotificationItem that takes care of sanitising. But again, whenever possible, fix it on the server side before you create the notification.

Sorry for the mis direction in the readme. I've fixed that, and clarified the current status as per above.

[DavideArgellati]

yes makes sense thank you for clarifying