31 lines
1.2 KiB
Markdown
31 lines
1.2 KiB
Markdown
# F-077 — Implementer evidence: Product short description renders HTML in admin product list
|
|
|
|
## Problem
|
|
|
|
The admin product listing rendered `p.description` as plain text. HTML tags like `<strong>`, `<em>` were shown as literal text (e.g., `<strong>Fresh</strong>`) instead of formatted text (**Fresh**).
|
|
|
|
## Changes
|
|
|
|
`project/apps/admin/src/app/(dashboard)/products/page.tsx`:
|
|
- Added `renderHtml(html)` helper function:
|
|
- Strips `<script>` tags (XSS vector)
|
|
- Strips `on*="..."` event handler attributes (XSS vector)
|
|
- Strips `javascript:` URLs
|
|
- Strips `<iframe>`, `<object>`, `<embed>` tags
|
|
- Preserves safe formatting tags: `<b>`, `<i>`, `<em>`, `<strong>`, `<br>`, `<p>`, `<span>`, `<u>`, etc.
|
|
- Replaced `{p.description?.slice(0, 60) ?? p.slug}` with `dangerouslySetInnerHTML={{ __html: renderHtml(p.description ?? '').slice(0, 60) || p.slug }}`
|
|
- The `truncate` CSS class still works on the rendered HTML
|
|
|
|
## Verification
|
|
|
|
- `npx tsc --noEmit` admin — exit 0 ✅
|
|
- `npx eslint` on changed file — exit 0 ✅
|
|
- `./scripts/verify.sh` — exit 0 ✅
|
|
|
|
## Files touched
|
|
|
|
```
|
|
project/apps/admin/src/app/(dashboard)/products/page.tsx (modified)
|
|
work/artifacts/F-077/implementer.md (this file)
|
|
```
|