fix: preserve literal report text and catalog searches

Merged
PR
2d ago
+170-48

Preserve literal text in report descriptions, PC report notes and catalog searches. The old denylist turned resolution=1920x1080 into resoluti1920x1080, removed comparisons such as <3, and erased literal javascript: examples. Surrounding whitespace still trims consistently.

All four callers were audited: descriptions render through JSX, notes through the existing text/DOMPurify Markdown boundary, and search values remain Prisma parameters. Remove the unused denylist and its stale test mocks. Encode < in JSON-LD at the shared script boundary, following Next.js guidance, while preserving the exact underlying JSON text. This follows OWASP guidance on free-form text and output encoding.

Validation: 62 focused tests pass; 16 storage/search regressions and the JSON-LD regression failed before their fixes. Required lint, TypeScript and full unit checks pass (2,756 tests). Tests exercise the real search procedures and storage paths, plus the existing plain-text and sanitized Markdown rendering boundaries.

Addresses the plain-text sanitization item in #442; the remaining schema-validation work stays open.

Summary by cubic

Removes the denylist sanitizer so literal text survives in report descriptions, PC report notes, and catalog searches. The old sanitizer turned resolution=1920x1080 into resoluti1920x1080, stripped comparisons like <3, and erased literal javascript: examples. Descriptions now trim whitespace only, search values stay Prisma parameters, notes pass through the existing Markdown sanitization boundary, and < is encoded in JSON-LD output to prevent script breakout. Adds 62 focused tests covering storage, search, rendering, and session boundaries. Addresses the plain-text sanitization item in #442.

Summary by CodeRabbit

  • Bug Fixes
    • Search terms are trimmed without altering symbols, links, or non-English text.
    • Report descriptions and notes retain submitted content and formatting while surrounding whitespace is removed.
    • Structured metadata safely handles angle brackets. Plain-text fallback displays HTML-like text without rendering it, while Markdown removes unsafe scripts, event handlers, and JavaScript links.
    • Admin forms better preserve drafts across refreshes and record changes, and prevent dismissal during pending saves.
    • Image selectors, autocomplete, and URL-selected catalog details update more reliably as results or selections change.
  • Improvements
    • Cookie consent now offers a retry when saving preferences fails.
    • Some catalog and performance forms remain open after successful saves.