From 36e2d90ee8f05553ce2d396e891ae5a9d6f7161e Mon Sep 17 00:00:00 2001
From: Jon Seager <jon@sgrs.uk>
Date: Fri, 13 Feb 2026 15:11:36 +0000
Subject: [PATCH] refactor: document content|safe safety invariant in templates
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add comments explaining why the |safe filter is used in data.html and
stats.html — content is always pre-rendered HTML from render_template().
---
 templates/pages/data.html  | 1 +
 templates/pages/stats.html | 1 +
 2 files changed, 2 insertions(+)

diff --git a/templates/pages/data.html b/templates/pages/data.html
index a0b662a..4487d92 100644
--- a/templates/pages/data.html
+++ b/templates/pages/data.html
@@ -20,6 +20,7 @@
       />
     </div>
 
+    {# Safety: content is always pre-rendered from another Askama template via render_template() #}
     <div id="data-content" class="data-page-content">{{ content|safe }}</div>
   </div>
 
diff --git a/templates/pages/stats.html b/templates/pages/stats.html
index eb53e26..31cc66c 100644
--- a/templates/pages/stats.html
+++ b/templates/pages/stats.html
@@ -27,6 +27,7 @@
     <div class="flex flex-col gap-6">
       {% include "partials/tab_bar.html" %}
 
+      {# Safety: content is always pre-rendered from another Askama template via render_template() #}
       <div id="stats-content">{{ content|safe }}</div>
     </div>