feat(F-077): completed feature

project/apps/admin/src/app/(dashboard)/products/page.tsx

@@ -12,6 +12,19 @@ function formatPrice(cents?: number) {
   return `€${(cents / 100).toFixed(2)}`;
 }
 
+/** Renders HTML safely: strips dangerous tags while preserving safe formatting. */
+function renderHtml(html: string): string {
+  if (!html) return '';
+  return html
+    .replace(/<script\b[^<]*(?:(?!<\/script>)<[^<]*)*<\/script>/gi, '')
+    .replace(/\son\w+="[^"]*"/gi, '')
+    .replace(/\son\w+='[^']*'/gi, '')
+    .replace(/javascript:/gi, '')
+    .replace(/<iframe/gi, '&lt;iframe')
+    .replace(/<object/gi, '&lt;object')
+    .replace(/<embed/gi, '&lt;embed');
+}
+
 function StateBadge({ state }: { state: string }) {
   const map: Record<string, { label: string; cls: string }> = {
     active: { label: 'Activo', cls: 'bg-green-100 text-green-800' },
@@ -207,9 +220,12 @@ export default function ProductsPage() {
                           <p className="text-sm font-medium text-gray-900 truncate max-w-xs">
                             {p.name}
                           </p>
-                          <p className="text-xs text-gray-400 truncate max-w-xs">
-                            {p.description?.slice(0, 60) ?? p.slug}
-                          </p>
+                          <p
+                            className="text-xs text-gray-400 truncate max-w-xs"
+                            dangerouslySetInnerHTML={{
+                              __html: renderHtml(p.description ?? '').slice(0, 60) || p.slug,
+                            }}
+                          />
                         </div>
                       </div>
                     </td>