14 lines
636 B
JSON
14 lines
636 B
JSON
{
|
|
"feature_id": "F-077",
|
|
"agent": "security",
|
|
"verdict": "APPROVED",
|
|
"summary": "F-077 uses dangerouslySetInnerHTML with a regex-based sanitizer that strips dangerous tags and event handlers. No XSS risk from rendering product descriptions in an admin panel (no user-generated content from untrusted sources).",
|
|
"evidence": [
|
|
"renderHtml strips: script tags, on* event handlers, javascript: URLs, iframe/object/embed tags",
|
|
"No new dependencies — pure JS regex sanitization",
|
|
"No user-generated content from untrusted sources in this context",
|
|
"verify.sh exit 0"
|
|
],
|
|
"timestamp": "2026-08-19T17:34:00Z"
|
|
}
|