From b813bc578e09f60a0cebb3e8e9dc824e03f78960 Mon Sep 17 00:00:00 2001
From: Andy Lee <andy.lee@suse.com>
Date: Fri, 17 Jul 2026 17:30:59 +0800
Subject: [PATCH] docs: add XSS safety comment for VM display name annotation
 (#1019)

Signed-off-by: Andy Lee <andy.lee@suse.com>
---
 pkg/harvester/edit/kubevirt.io.virtualmachine/index.vue | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkg/harvester/edit/kubevirt.io.virtualmachine/index.vue b/pkg/harvester/edit/kubevirt.io.virtualmachine/index.vue
index e064d274..4e69d28a 100644
--- a/pkg/harvester/edit/kubevirt.io.virtualmachine/index.vue
+++ b/pkg/harvester/edit/kubevirt.io.virtualmachine/index.vue
@@ -93,6 +93,9 @@ export default {
 
     const hostname = this.value.spec.template.spec.hostname || '';
 
+    // Display name can contain arbitrary strings. There is no XSS risk because the value is
+    // rendered via Vue's {{ }} interpolation which auto-escapes HTML; v-html is never used for
+    // this field. See harvester/harvester#10423 for details.
     const customizeDisplayName = !!(this.value.metadata?.annotations?.[HCI_ANNOTATIONS.VM_DISPLAY_NAME]);
 
     return {