Conversation
wilson-ai-jm
force-pushed
the
feat/dashboard-web-mvp
branch
from
be50395 to
1b133a1
Compare
added 5 commits
March 26, 2026 18:23
- Replace innerHTML string interpolation with DOM APIs (textContent) for all untrusted dynamic values (instrument names, symbols, error messages) to close reflected XSS vectors. - Change default sparkline range from 30d to 7d to avoid large JSON payloads; picks shortest available range so 7d is used when present. - Keep decimal values as strings for display; only convert to Number where numeric comparison is strictly needed, avoiding JS floating-point rounding errors on financial data. - Add explanatory comments in code. - Update README to document the 7d default.
Convert renderSparkline() to return a DOM node (span with SVG children) instead of an HTML string. This eliminates the last innerHTML call and ensures all dynamic content construction uses DOM APIs or textContent. Updated corresponding test expectation for sparklines URL.
Repository owner
deleted a comment from
codecov-commenter
Mar 26, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this PR does
/and/dashboardGET /api/v1/dashboardWhy this idea
This implements the Dashboard Web MVP idea from the feature backlog PR (#57): a minimal browser UI on top of the dashboard endpoint instead of introducing a full SPA.
Validation
go test ./internal/interfaces/http -run "TestDashboardPageRoutes|TestGetDashboard|TestParseSparklineDays"go test ./cmd/tracker -run TestBuildServerBoth were executed inside
golang:1.26Docker because Go is not installed on the host PATH.Notes
cmd/trackerintegration tests still rely on a Docker/testcontainers setup and were intentionally not used as the acceptance signal for this PR