Parse xss before extracting mentions/hashtags

backend/src/middleware/index.js

@@ -18,25 +18,26 @@ import sentry from './sentryMiddleware'
 
 export default schema => {
   const middlewares = {
-    permissions,
     sentry,
+    permissions,
+    xss,
     activityPub,
     validation,
     sluggify,
     excerpt,
+    email,
     notifications,
     hashtags,
-    xss,
     softDelete,
     user,
     includedFields,
     orderBy,
-    email,
   }
 
   let order = [
     'sentry',
     'permissions',
+    'xss',
     // 'activityPub', disabled temporarily
     'validation',
     'sluggify',
@@ -44,7 +45,6 @@ export default schema => {
     'email',
     'notifications',
     'hashtags',
-    'xss',
     'softDelete',
     'user',
     'includedFields',