Function sanitizeMessage

packages/shared/src/features/onboarding/lib/utils.ts:11–27

(
  message: string,
  allowedTags = ['b', 'strong', 'br'],
  allowedAttributes = ['class'],
)

 * Sanitizes HTML string and allows only bold tags
 */
export const sanitizeMessage = (
  message: string,
  allowedTags = ['b', 'strong', 'br'],
  allowedAttributes = ['class'],
): string => {
  // Only run on client-side
  if (typeof window === 'undefined') {
    return message;
  }

  const purify = createDOMPurify(window);

  return purify.sanitize(message, {
    ALLOWED_TAGS: allowedTags,
    ALLOWED_ATTR: allowedAttributes,
  });
};

const brokenWebviewPatterns = [
  /FBAN|FBAV/i, // Facebook App