mercadodevida/work/artifacts/F-077/implementer.md

F-077 — Implementer evidence: Product short description renders HTML in admin product list

Problem

The admin product listing rendered p.description as plain text. HTML tags like <strong>, <em> were shown as literal text (e.g., <strong>Fresh</strong>) instead of formatted text (Fresh).

Changes

project/apps/admin/src/app/(dashboard)/products/page.tsx:

• Added renderHtml(html) helper function:
  • Strips <script> tags (XSS vector)
  • Strips on*="..." event handler attributes (XSS vector)
  • Strips javascript: URLs
  • Strips <iframe>, <object>, <embed> tags
  • Preserves safe formatting tags: <b>, <i>, <em>, <strong>, <br>, <p>, <span>, <u>, etc.
• Replaced {p.description?.slice(0, 60) ?? p.slug} with dangerouslySetInnerHTML={{ __html: renderHtml(p.description ?? '').slice(0, 60) || p.slug }}
• The truncate CSS class still works on the rendered HTML

Verification

• npx tsc --noEmit admin — exit 0 ✅
• npx eslint on changed file — exit 0 ✅
• ./scripts/verify.sh — exit 0 ✅

Files touched

project/apps/admin/src/app/(dashboard)/products/page.tsx   (modified)
work/artifacts/F-077/implementer.md                     (this file)