Skip to content

Conversation

@james-cross
Copy link
Collaborator

Summary

  • Add DOMPurify dependency for HTML sanitisation
  • Create sanitiseBannerDescription utility to safely render rich text content
  • Update Banner component to render HTML descriptions using dangerouslySetInnerHTML with sanitisation

This enables banners to display formatted text (bold, italic, underline) and links in their descriptions, matching the new rich text editor in the admin CMS.

Test plan

  • View banners with rich text descriptions on staging
  • Verify formatting (bold, italic, underline) displays correctly
  • Verify links are clickable and open correctly
  • Confirm no XSS vulnerabilities by testing with malicious content

@james-cross james-cross merged commit 99ea949 into staging Jan 26, 2026
6 checks passed
james-cross added a commit that referenced this pull request Jan 26, 2026
* Fix/locations dropdown accessibility (#168)

* Increase e2e setup timeout and add retry logic for CI

* fix: remove non-public locations from navigation data

* feat: improve locations dropdown accessibility and layout

- Change to 4-column layout (one per letter bracket)
- Add ARIA group labelling with role and aria-labelledby
- Improve keyboard focus management with roving tabindex
- Add visible focus states for keyboard navigation

* Refactor/stats repository pattern (#169)

* Increase e2e setup timeout and add retry logic for CI

* refactor: add repository pattern for stats API to support CI without MongoDB

* fix: improve console error suppression for test noise

* Fix opening hours displaying incorrect days (#171)

* Increase e2e setup timeout and add retry logic for CI

* fix: correct day indexing for opening hours display

* Fix: Run prebuild fetch scripts during Vercel builds (#172)

* Increase e2e setup timeout and add retry logic for CI

* fix: correct day indexing for opening hours display

* fix: add buildCommand to run fetch scripts before Next.js build

* ci: skip redundant tests on main branch merges from staging (#173)

* Increase e2e setup timeout and add retry logic for CI

* ci: skip redundant tests on main branch merges from staging

* Update login button styling to stand out in navigation (#174)

* Increase e2e setup timeout and add retry logic for CI

* style: update login button to purple with white text

* feat: add form links to contact page and reusable get in touch banner (#176)

* fix: add proper label associations to organisation request form (#177)

* fix: improve form accessibility with focus management, labels, and contrast (#178)

* fix: update content and improve accessibility across multiple pages (#179)

* feat: redesign west-midlands page (#180)

* fix: update content and improve accessibility across multiple pages

* feat: redesign west-midlands page with hero, location cards, find help widget and regional stats

* fix: add dynamic export to west-midlands page (#182)

* fix: update content and improve accessibility across multiple pages

* feat: redesign west-midlands page with hero, location cards, find help widget and regional stats

* fix: add dynamic export to west-midlands page for banner fetching

* feat: add configurable limit prop to LocationFindHelp component (#185)

* perf: optimise database queries with parallel fetching and MongoDB geospatial (#184)

* feat: add configurable limit prop to LocationFindHelp component

* perf: optimise database queries with parallel fetching and MongoDB geospatial

* fix: resolve TypeScript error in accommodationData baseConditions type

* fix: improve disabled button contrast to meet WCAG AA standards (#186)

* fix: use separate API key for server-side geocoding (#189)

* feat: add UK GDPR compliant cookie consent banner (#191)

* Fix: Update tar to address CVE-2026-23950 (#188)

* fix: improve disabled button contrast to meet WCAG AA standards

* fix: update vulnerable dependencies to address CVE-2026-23950

* refactor(banners): simplify banner system to unified flexible component (#193)

* fix(resources): remove pointer cursor from resource cards (#194)

* Remove banner testing page

- Remove /testing-banners route that was causing build failures
- Test page was for development purposes only

* feat(banners): add rich text description support with sanitisation (#196)
james-cross added a commit that referenced this pull request Jan 26, 2026
* Fix/locations dropdown accessibility (#168)

* Increase e2e setup timeout and add retry logic for CI

* fix: remove non-public locations from navigation data

* feat: improve locations dropdown accessibility and layout

- Change to 4-column layout (one per letter bracket)
- Add ARIA group labelling with role and aria-labelledby
- Improve keyboard focus management with roving tabindex
- Add visible focus states for keyboard navigation

* Refactor/stats repository pattern (#169)

* Increase e2e setup timeout and add retry logic for CI

* refactor: add repository pattern for stats API to support CI without MongoDB

* fix: improve console error suppression for test noise

* Fix opening hours displaying incorrect days (#171)

* Increase e2e setup timeout and add retry logic for CI

* fix: correct day indexing for opening hours display

* Fix: Run prebuild fetch scripts during Vercel builds (#172)

* Increase e2e setup timeout and add retry logic for CI

* fix: correct day indexing for opening hours display

* fix: add buildCommand to run fetch scripts before Next.js build

* ci: skip redundant tests on main branch merges from staging (#173)

* Increase e2e setup timeout and add retry logic for CI

* ci: skip redundant tests on main branch merges from staging

* Update login button styling to stand out in navigation (#174)

* Increase e2e setup timeout and add retry logic for CI

* style: update login button to purple with white text

* feat: add form links to contact page and reusable get in touch banner (#176)

* fix: add proper label associations to organisation request form (#177)

* fix: improve form accessibility with focus management, labels, and contrast (#178)

* fix: update content and improve accessibility across multiple pages (#179)

* feat: redesign west-midlands page (#180)

* fix: update content and improve accessibility across multiple pages

* feat: redesign west-midlands page with hero, location cards, find help widget and regional stats

* fix: add dynamic export to west-midlands page (#182)

* fix: update content and improve accessibility across multiple pages

* feat: redesign west-midlands page with hero, location cards, find help widget and regional stats

* fix: add dynamic export to west-midlands page for banner fetching

* feat: add configurable limit prop to LocationFindHelp component (#185)

* perf: optimise database queries with parallel fetching and MongoDB geospatial (#184)

* feat: add configurable limit prop to LocationFindHelp component

* perf: optimise database queries with parallel fetching and MongoDB geospatial

* fix: resolve TypeScript error in accommodationData baseConditions type

* fix: improve disabled button contrast to meet WCAG AA standards (#186)

* fix: use separate API key for server-side geocoding (#189)

* feat: add UK GDPR compliant cookie consent banner (#191)

* Fix: Update tar to address CVE-2026-23950 (#188)

* fix: improve disabled button contrast to meet WCAG AA standards

* fix: update vulnerable dependencies to address CVE-2026-23950

* refactor(banners): simplify banner system to unified flexible component (#193)

* fix(resources): remove pointer cursor from resource cards (#194)

* Remove banner testing page

- Remove /testing-banners route that was causing build failures
- Test page was for development purposes only

* feat(banners): add rich text description support with sanitisation (#196)

* feat(banners): add border styling support (#197)

* fix(banners): correct description text colour for white text (#198)

* fix(banners): add prose-invert CSS for white text on dark backgrounds (#199)
james-cross added a commit that referenced this pull request Jan 26, 2026
* Fix/locations dropdown accessibility (#168)

* Increase e2e setup timeout and add retry logic for CI

* fix: remove non-public locations from navigation data

* feat: improve locations dropdown accessibility and layout

- Change to 4-column layout (one per letter bracket)
- Add ARIA group labelling with role and aria-labelledby
- Improve keyboard focus management with roving tabindex
- Add visible focus states for keyboard navigation

* Refactor/stats repository pattern (#169)

* Increase e2e setup timeout and add retry logic for CI

* refactor: add repository pattern for stats API to support CI without MongoDB

* fix: improve console error suppression for test noise

* Fix opening hours displaying incorrect days (#171)

* Increase e2e setup timeout and add retry logic for CI

* fix: correct day indexing for opening hours display

* Fix: Run prebuild fetch scripts during Vercel builds (#172)

* Increase e2e setup timeout and add retry logic for CI

* fix: correct day indexing for opening hours display

* fix: add buildCommand to run fetch scripts before Next.js build

* ci: skip redundant tests on main branch merges from staging (#173)

* Increase e2e setup timeout and add retry logic for CI

* ci: skip redundant tests on main branch merges from staging

* Update login button styling to stand out in navigation (#174)

* Increase e2e setup timeout and add retry logic for CI

* style: update login button to purple with white text

* feat: add form links to contact page and reusable get in touch banner (#176)

* fix: add proper label associations to organisation request form (#177)

* fix: improve form accessibility with focus management, labels, and contrast (#178)

* fix: update content and improve accessibility across multiple pages (#179)

* feat: redesign west-midlands page (#180)

* fix: update content and improve accessibility across multiple pages

* feat: redesign west-midlands page with hero, location cards, find help widget and regional stats

* fix: add dynamic export to west-midlands page (#182)

* fix: update content and improve accessibility across multiple pages

* feat: redesign west-midlands page with hero, location cards, find help widget and regional stats

* fix: add dynamic export to west-midlands page for banner fetching

* feat: add configurable limit prop to LocationFindHelp component (#185)

* perf: optimise database queries with parallel fetching and MongoDB geospatial (#184)

* feat: add configurable limit prop to LocationFindHelp component

* perf: optimise database queries with parallel fetching and MongoDB geospatial

* fix: resolve TypeScript error in accommodationData baseConditions type

* fix: improve disabled button contrast to meet WCAG AA standards (#186)

* fix: use separate API key for server-side geocoding (#189)

* feat: add UK GDPR compliant cookie consent banner (#191)

* Fix: Update tar to address CVE-2026-23950 (#188)

* fix: improve disabled button contrast to meet WCAG AA standards

* fix: update vulnerable dependencies to address CVE-2026-23950

* refactor(banners): simplify banner system to unified flexible component (#193)

* fix(resources): remove pointer cursor from resource cards (#194)

* Remove banner testing page

- Remove /testing-banners route that was causing build failures
- Test page was for development purposes only

* feat(banners): add rich text description support with sanitisation (#196)

* feat(banners): add border styling support (#197)

* fix(banners): correct description text colour for white text (#198)

* fix(banners): add prose-invert CSS for white text on dark backgrounds (#199)

* fix(banners): add border field mapping to API response (#201)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants