bsodfather/crank
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ui: start template safety cleanup

Browse Source
This commit is contained in:
a.tolmachev
2026-05-02 13:31:21 +00:00
parent a6e896ed89
commit 2f84a38b69
3 changed files with 43 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
TASKS.md
+4 -4
View File
@@ -2,14 +2,14 @@
## Current
### `feat/frontend-xss-hardening`
### `feat/frontend-template-safety-cleanup`
Status: in_progress
DoD:
- API-provided values are not rendered into `innerHTML` on user-facing admin pages
- error strings from API responses are rendered through text nodes
- streaming admin pages use DOM construction instead of HTML string concatenation for dynamic cards
- local UI helpers do not use `innerHTML` for static SVG or icon insertion
- wizard shell and workspace shell use DOM-based icon and fragment construction
- remaining HTML-bearing i18n/template paths are explicitly isolated and tracked
## Next