private String sanitizeHtml(FacesContext context, TextEditor component, String value) {
        String result = value;
        if (component.isSecure() && PrimeApplicationContext.getCurrentInstance(context).getEnvironment().isHtmlSanitizerAvailable()) {
            result = HtmlSanitizer.sanitizeHtml(value,
                    component.isAllowBlocks(), component.isAllowFormatting(),
                    component.isAllowLinks(), component.isAllowStyles(), component.isAllowImages());
        }
        else {
            if (!component.isAllowBlocks() || !component.isAllowFormatting()
                    || !component.isAllowLinks() || !component.isAllowStyles() || !component.isAllowImages()) {
                LOGGER.warning("HTML sanitizer not available - skip sanitizing....");
            }
        }
        return result;
    }
If security is enabled sanitize the HTML string to prevent XSS.

@param context the FacesContext
@param component the TextEditor instance
@param value the value to sanitize
@return the sanitized value
primefaces/src/main/java/org/primefaces/component/texteditor/TextEditorRenderer.java