Catalog descriptions come from outside your application. Some are plain text. Others contain markup, tracking links, broken tags, or content copied from a publisher's website. A description field is content to display, not code to execute.
The safe default for a short result card is plain text. Keep a length limit and preserve word boundaries when shortening it. A full show page can offer richer formatting if your renderer has an explicit allowlist.
Define a small display contract
Allow only the elements your interface needs, such as paragraphs, simple lists, emphasis, and links. Reject scripts, event handlers, embedded forms, and unexpected URL schemes. Use an established HTML sanitizer rather than a regular expression that removes one suspicious tag.
Sanitize after converting any supported markup into HTML. Escaping before a later conversion step can leave another path for unsafe content. Keep the process consistent across the web page, a preview modal, and an exported description.
Links need their own checks. A visible label may look harmless while its destination uses a different scheme or host. Open external navigation in a way that fits your platform and avoids giving another page access to the opener where relevant.
Include hostile fixtures in review
Test an ordinary paragraph, a malformed list, an image with an event handler, and a link using a non-web scheme. Your page should remain readable without executing the extra behavior.
Also test very long unbroken text and a description in a right-to-left language. Security and layout meet here: a safe renderer should not turn unusual publisher text into an unusable page.
Keep the original catalog content separate from your sanitized display version so later renderer improvements do not require guessing what the publisher originally supplied.