feat(F-077): completed feature

work/artifacts/F-077/implementer.md

@@ -0,0 +1,30 @@
+# F-077 — Implementer evidence: Product short description renders HTML in admin product list
+
+## Problem
+
+The admin product listing rendered `p.description` as plain text. HTML tags like `<strong>`, `<em>` were shown as literal text (e.g., `<strong>Fresh</strong>`) instead of formatted text (**Fresh**).
+
+## Changes
+
+`project/apps/admin/src/app/(dashboard)/products/page.tsx`:
+- Added `renderHtml(html)` helper function:
+  - Strips `<script>` tags (XSS vector)
+  - Strips `on*="..."` event handler attributes (XSS vector)
+  - Strips `javascript:` URLs
+  - Strips `<iframe>`, `<object>`, `<embed>` tags
+  - Preserves safe formatting tags: `<b>`, `<i>`, `<em>`, `<strong>`, `<br>`, `<p>`, `<span>`, `<u>`, etc.
+- Replaced `{p.description?.slice(0, 60) ?? p.slug}` with `dangerouslySetInnerHTML={{ __html: renderHtml(p.description ?? '').slice(0, 60) || p.slug }}`
+- The `truncate` CSS class still works on the rendered HTML
+
+## Verification
+
+- `npx tsc --noEmit` admin — exit 0 ✅
+- `npx eslint` on changed file — exit 0 ✅
+- `./scripts/verify.sh` — exit 0 ✅
+
+## Files touched
+
+```
+project/apps/admin/src/app/(dashboard)/products/page.tsx   (modified)
+work/artifacts/F-077/implementer.md                     (this file)
+```