From dde41bc5d16b25bb580344e01cda1bfc11e81659 Mon Sep 17 00:00:00 2001
From: jtricerolph <info@tricerolph.com>
Date: Mon, 13 Jul 2026 09:25:02 +0000
Subject: [PATCH] Escape HTML entities before rendering AI insight content

The renderContent() function used dangerouslySetInnerHTML without
first sanitizing the AI-generated text, allowing any HTML in the
model response to execute in the browser. Added escHtml() helper
and applied it before the bold-substitution regex.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 frontend/src/pages/Dashboard.tsx | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/frontend/src/pages/Dashboard.tsx b/frontend/src/pages/Dashboard.tsx
index dae402b..3bcc934 100644
--- a/frontend/src/pages/Dashboard.tsx
+++ b/frontend/src/pages/Dashboard.tsx
@@ -23,9 +23,17 @@ function formatAge(iso: string): string {
   return `${Math.floor(hours / 24)}d ago`
 }
 
+function escHtml(s: string): string {
+  return s
+    .replace(/&/g, '&amp;')
+    .replace(/</g, '&lt;')
+    .replace(/>/g, '&gt;')
+}
+
 function renderContent(text: string) {
   return text.split('\n').map((line, i) => {
-    const processed = line.replace(/\*\*(.+?)\*\*/g, '<strong>$1</strong>')
+    const safe = escHtml(line)
+    const processed = safe.replace(/\*\*(.+?)\*\*/g, '<strong>$1</strong>')
     if (line.startsWith('- ') || line.startsWith('* ')) {
       return (
         <div key={i} style={{ display: 'flex', gap: 8, marginBottom: 4 }}>