About The Pull Request Unsanitized input allows for raw HTML injection on broadcasting message as blob. The repeated message by blob mobs is sanitized, so clients are safe, but still allows HTML injection into the blob's chat window.