forecasting/frontend
jtricerolph dde41bc5d1 Escape HTML entities before rendering AI insight content
The renderContent() function used dangerouslySetInnerHTML without
first sanitizing the AI-generated text, allowing any HTML in the
model response to execute in the browser. Added escHtml() helper
and applied it before the bold-substitution regex.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-07-13 09:25:02 +00:00
..
public Replace letter icons with Lucide PWA icons 2026-07-11 20:30:11 +00:00
src Escape HTML entities before rendering AI insight content 2026-07-13 09:25:02 +00:00
Dockerfile Forecasting app: hybrid port to HNF stack 2026-07-04 18:49:34 +00:00
index.html Forecasting app: hybrid port to HNF stack 2026-07-04 18:49:34 +00:00
nginx.conf Make forecasting installable as a PWA 2026-07-11 11:27:00 +00:00
package-lock.json Make forecasting installable as a PWA 2026-07-11 11:27:00 +00:00
package.json Make forecasting installable as a PWA 2026-07-11 11:27:00 +00:00
tsconfig.json Forecasting app: hybrid port to HNF stack 2026-07-04 18:49:34 +00:00
vite.config.ts Replace letter icons with Lucide PWA icons 2026-07-11 20:30:11 +00:00