From b175ea422532d879ec021bb335cd8e3151339af0 Mon Sep 17 00:00:00 2001
From: bot-frontend <bot-frontend@gendsgn.local>
Date: Sat, 30 May 2026 16:58:14 +0000
Subject: [PATCH] =?UTF-8?q?fix(tradein):=20=D1=81=D0=B0=D0=BD=D0=B8=D1=82?=
 =?UTF-8?q?=D0=B8=D0=B7=D0=B0=D1=86=D0=B8=D1=8F=20brand.logo=5Furl=20+=20?=
 =?UTF-8?q?=D0=B2=D0=B0=D0=BB=D0=B8=D0=B4=D0=B0=D1=86=D0=B8=D1=8F=20brand-?=
 =?UTF-8?q?=D1=86=D0=B2=D0=B5=D1=82=D0=BE=D0=B2=20(#766)=20(#791)=20Co-aut?=
 =?UTF-8?q?hored-by:=20bot-frontend=20<bot-frontend@gendsgn.local>=20Co-co?=
 =?UTF-8?q?mmitted-by:=20bot-frontend=20<bot-frontend@gendsgn.local>?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 tradein-mvp/frontend/src/app/page.tsx             | 11 +++++++++--
 .../frontend/src/components/trade-in/Topbar.tsx   | 15 +++++++++++++--
 2 files changed, 22 insertions(+), 4 deletions(-)

diff --git a/tradein-mvp/frontend/src/app/page.tsx b/tradein-mvp/frontend/src/app/page.tsx
index 2d8e49a8..df6e7058 100644
--- a/tradein-mvp/frontend/src/app/page.tsx
+++ b/tradein-mvp/frontend/src/app/page.tsx
@@ -58,8 +58,15 @@ export default function TradeInPage() {
   useEffect(() => {
     const root = document.documentElement;
     if (!brand) return;
-    root.style.setProperty("--accent", brand.primary_color); // зелёный (бренд)
-    root.style.setProperty("--accent-2", brand.accent_color); // циан (акцент)
+    // Бренд-цвета идут в CSS custom-property без доверия (#766: подменённый бренд
+    // → CSS-инъекция). Применяем только валидный hex / rgb()/hsl(); иначе дефолт.
+    const COLOR_RE = /^#[0-9a-fA-F]{3,8}$|^(rgb|hsl)a?\([\d.,%\s/]+\)$/;
+    if (COLOR_RE.test(brand.primary_color)) {
+      root.style.setProperty("--accent", brand.primary_color); // зелёный (бренд)
+    }
+    if (COLOR_RE.test(brand.accent_color)) {
+      root.style.setProperty("--accent-2", brand.accent_color); // циан (акцент)
+    }
     root.classList.add("brand-active");
     return () => {
       root.style.removeProperty("--accent");
diff --git a/tradein-mvp/frontend/src/components/trade-in/Topbar.tsx b/tradein-mvp/frontend/src/components/trade-in/Topbar.tsx
index a2737747..8bdec5bf 100644
--- a/tradein-mvp/frontend/src/components/trade-in/Topbar.tsx
+++ b/tradein-mvp/frontend/src/components/trade-in/Topbar.tsx
@@ -5,6 +5,7 @@
 import { UserMenu } from "@/components/auth/UserMenu";
 import { API_BASE_URL, HTTPError } from "@/lib/api";
 import { isPathAllowed } from "@/lib/isPathAllowed";
+import { safeUrl } from "@/lib/safeUrl";
 import { useBrand } from "@/lib/useBrand";
 import { useMe } from "@/lib/useMe";
 
@@ -94,9 +95,19 @@ export function Topbar({ active }: TopbarProps) {
     <header className="topbar">
       <div className="topbar-inner">
         <div className="brand">
-          {brand?.logo_url ? (
+          {brand ? (
             <>
-              <img src={brand.logo_url} alt={brand.name} className="brand-logo" />
+              {/* logo_url из бренд-конфига → safeUrl (блок javascript:/data: схем, #766).
+                  Невалидный URL → fallback на TI-марку, без broken/опасного img. */}
+              {safeUrl(brand.logo_url) ? (
+                <img
+                  src={safeUrl(brand.logo_url) as string}
+                  alt={brand.name}
+                  className="brand-logo"
+                />
+              ) : (
+                <span className="brand-mark">TI</span>
+              )}
               <span className="brand-product">{brand.name}</span>
             </>
           ) : (