costa-rica: escape p.description in card innerHTML (Cody ARGUE XSS fix, TK-10093)

8c8ebde39db652510d96c4e9f0d616ed2c1ac9f0 · 2026-08-01 20:47:41 -0700 · Steve

Files touched

M public/index.html

Diff

commit 8c8ebde39db652510d96c4e9f0d616ed2c1ac9f0
Author: Steve <steve@designerwallcoverings.com>
Date:   Sat Aug 1 20:47:41 2026 -0700

    costa-rica: escape p.description in card innerHTML (Cody ARGUE XSS fix, TK-10093)
---
 public/index.html | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/public/index.html b/public/index.html
index 128dc5d..e32ea76 100644
--- a/public/index.html
+++ b/public/index.html
@@ -286,7 +286,7 @@
           <div class="cat">${catDrill}</div>
           <div class="name">${esc(p.name)}</div>
           <div class="where">${regionDrill}</div>
-          <div class="desc">${p.description||''}</div>
+          <div class="desc">${esc(p.description||'')}</div>
           <div class="row">
             <span class="badge ${p.verified?'verified':''}">${p.verified?'verified':p.source||'pending'}</span>
             ${p.rating?`<span class="badge">★ ${(+p.rating).toFixed(1)}</span>`:''}

← b3cbf1b costa-rica: adopt href-to-deeper-data primitives (TK-10093) · back to Costa Rica · costa-rica: marketplace schema migration 004 (bookings, paym e36298c →