`malden-house/rereview.md`

32 lines
## Verdict
FIX BEFORE SHIP

## Patches reviewed
`dashboard.js:17` — add escaping helper — works, but collapses numeric `0` — concern  
`dashboard.js:39` — escape rental cards — partial; stored price still unescaped — concern  
`dashboard.js:149` — escape inquiry inbox — patched path looks good — good  
`dashboard.js:193` — escape photo picker/photo attrs — patched path looks good — good  
`browse.js:7` — add escaping helper — works, but collapses numeric `0` — concern  
`browse.js:44` — escape browse cards/map query — partial; stored price still unescaped — concern  
`rental.js:35` — add escaping helpers — works, but collapses numeric `0` — concern  
`rental.js:89` — escape trailer/cover text — patched path looks good — good  
`rental.js:329` — escape property card subline — patched path looks good — good  
`rental.js:383` — escape event grid fields — mostly good; numeric `min`/`0` display edge remains — concern  
`rental.js:503` — escape remaining rental template paths — partial; nearby stored-data `innerHTML` paths remain — concern

## New issues introduced
`rental.js:35` — `escapeHtml(s)` uses `String(s || "")`, so numeric `0` becomes empty; applied numeric call-sites like `rental.js:503` can render blank drive minutes — P2

## Missed call-sites (same problem elsewhere)
`dashboard.js:59` — stored `r.price.mid` is inserted into `innerHTML` unescaped; JSON strings have `.toLocaleString()` and can inject markup  
`browse.js:63` — same stored `r.price.mid` unescaped in browse card `innerHTML`  
`rental.js:139` — stored `price.mid` inserted into trailer outro `innerHTML` unescaped  
`rental.js:619` — stored `price.mid`, `price.low`, `price.high`, `baseline.base` inserted into price card `innerHTML` unescaped  
`rental.js:422` — `NB.guideH2(address.city)` can interpolate stored `address.city` into `innerHTML` for the default neighborhood  
`rental.js:459` — `hH2` can interpolate stored `address.city` into `historyCopy.innerHTML` for the default neighborhood  
`signup.js:226` — signup success status renders submitted/geocoded fields through `setStatus(...innerHTML...)` without escaping  
`signup.js:312` — autocomplete renders Nominatim response fields into `innerHTML`; only double quotes in `data-val` are escaped

## Recommendations
- Replace `String(s || "")` with `String(s ?? "")`, and escape or type-normalize every stored numeric field before template insertion.
- Add one shared escape helper and use it in signup/autocomplete plus the remaining rental/dashboard/browse `innerHTML` paths.