14 lines
922 B
JSON
14 lines
922 B
JSON
{
|
|
"feature_id": "F-068",
|
|
"agent": "security",
|
|
"verdict": "APPROVED",
|
|
"summary": "dangerouslySetInnerHTML is now used on the listing-card description. The description was already writable via the admin editor and was already rendered via dangerouslySetInnerHTML on the product detail page (F-064); the same string is now also rendered on the listing cards. The admin role is is the only role that can PATCH product descriptions, so the source of HTML is fully gated.",
|
|
"evidence": [
|
|
"PATCH /api/products/:id requires admin role (unchanged)",
|
|
"The admin product editor (F-062 / F-064) is the only path that produces HTML on the description",
|
|
"dangerouslySetInnerHTML is also used on the product detail page (F-064) — same string source",
|
|
"Public endpoint GET /products/search is read-only",
|
|
"No new endpoints, no new dependencies, no new env vars"
|
|
],
|
|
"timestamp": "2026-08-19T15:45:00Z"
|
|
} |