The message interaction body is a plain textarea, so an author types raw HTML, which is rendered safely (Xss::filterAdmin). It would be friendlier to author basic formatting (bold, italic, links, lists) in an editor.
Proposed resolution
Make the message field a text_format element pinned to the restricted_html format: a single allowed format hides the selector and gives a basic editor. The interaction flattens the submitted value/format pair back to a plain string in submitConfigurationForm, so storage is unchanged: the message stays a string, existing values keep working with no migration, and output stays filtered as admin HTML.
Remaining tasks
Review the merge request.
Issue fork orchestra-3606884
Show commands
Start within a Git clone of the project using the version control instructions.
Or, if you do not have SSH keys set up on git.drupalcode.org:
Comments
Comment #3
mably commentedComment #5
mably commented