Skip to content

bug: document.write used for printable comparison page #422

Description

@nanaf6203-bit

Summary

src/app/compare/page.tsx uses printWindow.document.write(html) to render a printable comparison view.

Affected area

src/app/compare/page.tsx (line ~190)

Steps to reproduce / impact

document.write after the document has been opened re-parses the document, breaks CSP unsafe-inline expectations, opens the door to injection if the html string ever embeds untrusted data, and is a known anti-pattern.

Expected behaviour

Replace with a regular Next.js printable route (/compare/print) rendered server-side, OR construct DOM via document.createElement and appendChild.

Acceptance criteria

  • Remove all document.write calls.
  • Confirm CSP does not need unsafe-inline for the print view.
  • Add a regression test that opens the printable view and finds expected headings.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

Stellar WaveIssues in the Stellar wave programbugSomething isn't working correctlypriority/p1P1 — high priority, fix soonsecuritySecurity issue or hardening opportunity

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions