egg/DashBoard
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
b56e80381bc3e67a8289063c8c5db8530252486b
DashBoard/openspec/changes/archive/2026-02-07-hold-detail-vite-hardening/specs/field-contract-governance/spec.md
beabigegg b56e80381b chore: reinitialize project with vite architecture
2026-02-08 08:30:48 +08:00

493 B
Raw Blame History

ADDED Requirements

Requirement: Hold Detail Dynamic Rendering MUST Sanitize Untrusted Values

Dynamic table and distribution rendering in hold-detail SHALL sanitize untrusted text before injecting into HTML attributes or content.

Scenario: Hold reason distribution contains HTML-like payload

  • WHEN workcenter/package/lot fields include HTML-like text from upstream data
  • THEN the hold-detail page MUST render escaped text and MUST NOT execute embedded markup or scripts