Cms Fix 3

loom-builderpromptmarkdown
Path: loom-builder/prompts/cms-fix-3.mdRelative: prompts/cms-fix-3.mdSubproject: loom-builderCategory: dispatch-prompts
Lines: 32Bytes: 2,446Imports: 0Exports: 0
loom-builderpromptmarkdownprompts

Content Preview

  1. # ROLE
  2. Frontend engineer applying a security-reviewed fix list to vanilla-JS UI. Write ROLE/GOAL/PLAN checklist first. Surgical changes only — exactly these four fixes.
  4. # REPO
  5. `/home/mikes/leverage-cms/leverageai-cms-v2/` — files: `worker/ui/app.js`, `worker/ui/api.js`. Review findings in `REVIEW_SPRINT4.md` (read it).
  7. # FIXES
  9. ## F1 — XSS in AI assistant + system messages (BLOCKER)
  10. `worker/ui/app.js`: `addAiMessage` (~line 76) assigns `innerHTML` from raw user/dynamic input; `showPanel` (~lin