Security: does Editor.js sanitize the text and links before displaying it?

Suppose that you have multiple users that collaborate on the same document.

For example:

1. User A creates a document and inserts some malicious code like `This is a paragraph with [a link](javascript:alert('XSS!'))`
2. The document is sent to the server
3. User B opens the document and the existing data is loaded into Editor.js
4. If the HTML is not sanitized by Editor.js, the JSON is converted back to HTML and arbitrary JS execution happens.

Does Editor.js sanitize the HTML tags and links when it loads them from existing JSON data?

Ideally Editor.js should perform the following sanitizations:
- allow only certain tags in the text (eg. ``, ``, ``)
- allow only safe protocols for `` (e.g. `https:`, but not `javascript:`)