diff --git a/backlog/features.json b/backlog/features.json index dd1d3aa..eb86475 100644 --- a/backlog/features.json +++ b/backlog/features.json @@ -3658,13 +3658,15 @@ "No XSS risk from rendering", "verify.sh is green" ], - "status": "pending", + "status": "done", "created_at": "2026-08-19", "gates": { - "reviewer": false, - "security": false, - "qa": false - } + "reviewer": true, + "security": true, + "qa": true, + "close": true + }, + "completed_at": "2026-08-19T17:33:25Z" } ] } diff --git a/project/apps/admin/src/app/(dashboard)/products/page.tsx b/project/apps/admin/src/app/(dashboard)/products/page.tsx index 627ece2..ecfb710 100644 --- a/project/apps/admin/src/app/(dashboard)/products/page.tsx +++ b/project/apps/admin/src/app/(dashboard)/products/page.tsx @@ -12,6 +12,19 @@ function formatPrice(cents?: number) { return `€${(cents / 100).toFixed(2)}`; } +/** Renders HTML safely: strips dangerous tags while preserving safe formatting. */ +function renderHtml(html: string): string { + if (!html) return ''; + return html + .replace(/)<[^<]*)*<\/script>/gi, '') + .replace(/\son\w+="[^"]*"/gi, '') + .replace(/\son\w+='[^']*'/gi, '') + .replace(/javascript:/gi, '') + .replace(/