`VictoryStays/rereview.md`

21 lines
## Verdict
FIX BEFORE SHIP

## Patches reviewed
templates/city.html:454 — client-side XSS in city lookup `innerHTML` rendering — template helper and escaped interpolations look correct, but generated served pages were not updated — STATUS concern  
search.html:121 — client-side XSS in search result/permit rendering — helper is in scope and the edited dynamic text fields are escaped; no broken import/default observed — STATUS good

## New issues introduced
none observed

## Missed call-sites (same problem elsewhere)
beverly-hills.html:21968 — same unescaped city lookup pattern still present in generated served page  
beverly-hills.html:21997 — assessor link still inserted raw in generated served page  
burbank.html:15068 — same unescaped city lookup pattern still present in generated served page  
burbank.html:15097 — assessor link still inserted raw in generated served page  
west-hollywood.html:28500 — same unescaped city lookup pattern still present in generated served page  
west-hollywood.html:28529 — assessor link still inserted raw in generated served page

## Recommendations
- Regenerate `beverly-hills.html`, `west-hollywood.html`, and `burbank.html` from `templates/city.html`, or patch the generated files directly before shipping.
- After regeneration, re-check the cited generated-page lines because `server.js:51` serves those root HTML files directly.