[lucyxiang]

The markets recipe renders merchant-managed HTML from the Storefront API with dangerouslySetInnerHTML and does not sanitize it. A <script> tag or an onerror handler in a page, article, policy or product description runs for every visitor. This PR adds an allowlist sanitizer and calls it in each loader.

// Before
return {page};
// After
return {page: {...page, body: sanitizeHtml(page.body)}};

What this changes

• Adds the app/lib/sanitizeHtml.ts ingredient. It has no dependencies, so it runs in Oxygen, Node and the browser.
  • Keeps: formatting, lists, tables, details, images (http/https) and links (http, https, mailto, tel, relative).
  • Removes: script, style, iframe, object, embed, svg, math, form controls, on* handlers, style attributes and other URL schemes.
  • Decodes character references before it checks URLs, closes all elements that it opens, and runs in linear time.
• Sanitizes Page.body, Article.contentHtml, ShopPolicy.body and Product.descriptionHtml in their loaders.
• Adds step 1.6 to recipe.yaml, and gives the package.json step a description. The description was null.
• Regenerates README.md and llms/markets.prompt.md, and adds __tests__/sanitizeHtml.test.ts.

No changeset. The cookbook does not ship in a package.

Risk

• Merchants who use iframes (for example YouTube) or inline styles lose that markup.

[shopify]

Oxygen deployed a preview of your lucy/markets-sanitize-html branch. Details:

Storefront	Status	Preview link	Deployment details	Last update (UTC)
Skeleton (skeleton.hydrogen.shop)	✅ Successful (Logs)	Preview deployment	Inspect deployment	November 2, 2026 5:05 PM

Learn more about Hydrogen's GitHub integration.

[frandiox]

We could also rely directly on sanitize-html package but I guess for the cookbook it's not so important 👍