Ilia Denisov b54371845f harden(offer): escape admin product titles against HTML/markdown injection ...

The offer price list projects the admin-entered product title into a markdown
table cell that is rendered, unsanitised, into the public /offer/ page. Escape
the title at the projection boundary so it renders as literal text: HTML
metacharacters become entities and the markdown table pipe and link brackets are
escaped, so a title can neither inject markup nor form a javascript: link. The
committed offer prose keeps its trusted-content treatment (code-reviewed, not
runtime input).

2026-07-10 20:30:36 +02:00

..

boundary_test.go

feat(payments): add the payments schema, currency domain and money type

2026-07-08 01:07:56 +02:00

cache.go

feat(payments): chip wallet, store-compliance gate and benefit application

2026-07-08 06:06:40 +02:00

catalog_admin_test.go

feat(admin): product catalog editor

2026-07-10 05:18:54 +02:00

catalog_admin.go

feat(offer): live catalog price list in the public offer, served by the render sidecar

2026-07-10 20:25:41 +02:00

catalog_test.go

feat(payments): wallet screen with balances, benefits and storefront

2026-07-08 12:37:32 +02:00

catalog.go

feat(payments): wallet screen with balances, benefits and storefront

2026-07-08 12:37:32 +02:00

gate_test.go

fix(payments): VK-iOS freeze is purchase-only; remove the rewarded diagnostic

2026-07-10 01:27:26 +02:00

gate.go

fix(payments): VK-iOS freeze is purchase-only; remove the rewarded diagnostic

2026-07-10 01:27:26 +02:00

money_test.go

feat(payments): add the payments schema, currency domain and money type

2026-07-08 01:07:56 +02:00

offer_test.go

harden(offer): escape admin product titles against HTML/markdown injection

2026-07-10 20:30:36 +02:00

offer.go

harden(offer): escape admin product titles against HTML/markdown injection

2026-07-10 20:30:36 +02:00

payments.go

feat(payments): order-flow and fund credit engine + the Robokassa adapter

2026-07-09 16:48:48 +02:00

refund_admin.go

feat(admin): manual full-order refund + ledger CSV export

2026-07-10 06:46:18 +02:00

service_intake_test.go

fix(payments): VK-iOS freeze is purchase-only; remove the rewarded diagnostic

2026-07-10 01:27:26 +02:00

service_intake.go

feat(ads): VK post-move interstitial + retire deprecated hint_balance/paid_account

2026-07-10 02:48:10 +02:00

service.go

feat(offer): live catalog price list in the public offer, served by the render sidecar

2026-07-10 20:25:41 +02:00

statement.go

feat(admin): per-user finance panel — balances, benefits, risk, ledger

2026-07-10 04:55:55 +02:00

store_catalog_admin.go

feat(admin): product catalog editor

2026-07-10 05:18:54 +02:00

store_catalog.go

feat(payments): wallet screen with balances, benefits and storefront

2026-07-08 12:37:32 +02:00

store_intake.go

feat(ads): VK post-move interstitial + retire deprecated hint_balance/paid_account

2026-07-10 02:48:10 +02:00

store_statement.go

feat(admin): manual full-order refund + ledger CSV export

2026-07-10 06:46:18 +02:00

store_wallet.go

feat(admin): admin grant — raw benefits and by-product reward bundles

2026-07-10 05:35:55 +02:00

store.go

feat(payments): chip wallet, store-compliance gate and benefit application

2026-07-08 06:06:40 +02:00

wallet_test.go

fix(payments): VK-iOS freeze is purchase-only; remove the rewarded diagnostic

2026-07-10 01:27:26 +02:00