Summary
src/app/compare/page.tsx uses printWindow.document.write(html) to render a printable comparison view.
Affected area
src/app/compare/page.tsx (line ~190)
Steps to reproduce / impact
document.write after the document has been opened re-parses the document, breaks CSP unsafe-inline expectations, opens the door to injection if the html string ever embeds untrusted data, and is a known anti-pattern.
Expected behaviour
Replace with a regular Next.js printable route (/compare/print) rendered server-side, OR construct DOM via document.createElement and appendChild.
Acceptance criteria
Summary
src/app/compare/page.tsxusesprintWindow.document.write(html)to render a printable comparison view.Affected area
src/app/compare/page.tsx(line ~190)Steps to reproduce / impact
document.writeafter the document has been opened re-parses the document, breaks CSPunsafe-inlineexpectations, opens the door to injection if thehtmlstring ever embeds untrusted data, and is a known anti-pattern.Expected behaviour
Replace with a regular Next.js printable route (
/compare/print) rendered server-side, OR construct DOM viadocument.createElementandappendChild.Acceptance criteria
document.writecalls.unsafe-inlinefor the print view.