HTML content

Several etg24 API fields accept formatted text — including process descriptions, communication notes, and announcement bodies. To prevent cross-site scripting (XSS) and maintain layout consistency across web and mobile clients, the platform rigorously sanitizes all incoming HTML before persisting it.

Permitted HTML tags

Only a safe, well-defined subset of semantic HTML tags is preserved:

Allowed HTML attributes

To ensure consistent styling and prevent injection attacks, attributes are strictly filtered:

• On anchor tags (<a>), only href and target are retained.
• All other attributes (class, style, id, onclick, data-*) are stripped from every tag.

Stripping behavior & validation

Any tag not on the allowlist is stripped, while its inner text content is preserved. For example:

1
<!-- Input payload -->
2
<div class="custom-card"><span style="color:red">Notice:</span> Elevator maintenance scheduled.</div>
3

4
<!-- Stored output -->
5
Notice: Elevator maintenance scheduled.

Preventing validation errors on mandatory fields

If an API field is marked as mandatory (required) and an input payload consists entirely of disallowed tags (such as raw <img> or <script> tags without text), sanitization will strip the entire markup, reducing the value to an empty string. The API will then reject the request with a 400 Bad Request validation error.

Defensive formatting recommendations

1. Rely on semantic markup only: Do not depend on custom CSS classes, inline colors, or font sizes — they are dropped during sanitization.
2. Prefer plain text when formatting is optional: Plain text is always preserved verbatim and immune to sanitization side effects.
3. Verify payloads before production deployment: Test your rich-text templates with a staging request to confirm the rendered output matches your intent.