From 223c4564122fe4f7de43a892920a97f0afadc553 Mon Sep 17 00:00:00 2001
From: Arham Dugar <arham.dugar@harness.io>
Date: Sun, 22 Feb 2026 20:08:42 +0530
Subject: [PATCH 1/3] changes made

---
 .../ar/components/Form/DeleteModalContent.tsx |  8 +++++-
 .../useDeleteArtifactModal.tsx                | 13 ++++++++-
 .../useDeleteRepositoryModal.tsx              | 13 ++++++++-
 .../repository-list/strings/strings.en.yaml   |  4 +--
 .../VersionActions/DeleteVersionMenuItem.tsx  |  4 ++-
 .../hooks/useDeleteVersionModal.tsx           | 27 +++++++++++++++++--
 6 files changed, 61 insertions(+), 8 deletions(-)

diff --git a/web/src/ar/components/Form/DeleteModalContent.tsx b/web/src/ar/components/Form/DeleteModalContent.tsx
index cb97f6222a..5b49a62168 100644
--- a/web/src/ar/components/Form/DeleteModalContent.tsx
+++ b/web/src/ar/components/Form/DeleteModalContent.tsx
@@ -30,6 +30,7 @@ interface DeleteModalContentProps {
   content: string
   placeholder: string
   inputLabel: string
+  inputLabelValue?: string
   deleteBtnText?: string
 }
 
@@ -41,9 +42,14 @@ function DeleteModalContent({
   content,
   placeholder,
   inputLabel,
+  inputLabelValue,
   deleteBtnText
 }: DeleteModalContentProps) {
   const { getString } = useStrings()
+  
+  // Construct the label with the value appended if provided
+  const finalLabel = inputLabelValue ? `${inputLabel} (${inputLabelValue})` : inputLabel
+  
   return (
     <Formik
       initialValues={{ value: '' }}
@@ -61,7 +67,7 @@ function DeleteModalContent({
         <Container>
           <Layout.Vertical spacing="medium">
             <Text>{content}</Text>
-            <FormInput.Text label={inputLabel} name="value" placeholder={placeholder} intent={Intent.PRIMARY} />
+            <FormInput.Text label={finalLabel} name="value" placeholder={placeholder} intent={Intent.PRIMARY} />
           </Layout.Vertical>
           <Layout.Horizontal spacing="medium" margin={{ top: 'large' }}>
             <Button
diff --git a/web/src/ar/pages/artifact-details/hooks/useDeleteArtifactModal/useDeleteArtifactModal.tsx b/web/src/ar/pages/artifact-details/hooks/useDeleteArtifactModal/useDeleteArtifactModal.tsx
index 02cf476098..656baafc15 100644
--- a/web/src/ar/pages/artifact-details/hooks/useDeleteArtifactModal/useDeleteArtifactModal.tsx
+++ b/web/src/ar/pages/artifact-details/hooks/useDeleteArtifactModal/useDeleteArtifactModal.tsx
@@ -24,6 +24,13 @@ import { useStrings } from '@ar/frameworks/strings'
 import { encodeRef } from '@ar/hooks/useGetSpaceRef'
 import DeleteModalContent from '@ar/components/Form/DeleteModalContent'
 
+// Helper function to decode HTML entities
+const decodeHtmlEntities = (text: string): string => {
+  const textarea = document.createElement('textarea')
+  textarea.innerHTML = text
+  return textarea.value
+}
+
 interface useDeleteArtifactModalProps {
   repoKey: string
   artifactKey: string
@@ -39,6 +46,9 @@ export default function useDeleteArtifactModal(props: useDeleteArtifactModalProp
 
   const { mutateAsync: deleteArtifact } = useDeleteArtifactMutation()
 
+  // Decode HTML entities to display properly
+  const decodedArtifactKey = decodeHtmlEntities(artifactKey)
+
   const handleDeleteArtifact = async (): Promise<void> => {
     try {
       const response = await deleteArtifact({
@@ -67,12 +77,13 @@ export default function useDeleteArtifactModal(props: useDeleteArtifactModalProp
     contentText: (
       <DeleteModalContent
         entity="package"
-        value={artifactKey}
+        value={decodedArtifactKey}
         onSubmit={handleDeleteArtifact}
         onClose={handleCloseDialog}
         content={getString('artifactDetails.deleteModal.contentText')}
         placeholder={getString('artifactDetails.deleteModal.inputPlaceholder')}
         inputLabel={getString('artifactDetails.deleteModal.inputLabel')}
+        inputLabelValue={decodedArtifactKey}
       />
     ),
     customButtons: <></>,
diff --git a/web/src/ar/pages/repository-details/hooks/useDeleteRepositoryModal/useDeleteRepositoryModal.tsx b/web/src/ar/pages/repository-details/hooks/useDeleteRepositoryModal/useDeleteRepositoryModal.tsx
index 62b292d01a..1491179c8a 100644
--- a/web/src/ar/pages/repository-details/hooks/useDeleteRepositoryModal/useDeleteRepositoryModal.tsx
+++ b/web/src/ar/pages/repository-details/hooks/useDeleteRepositoryModal/useDeleteRepositoryModal.tsx
@@ -23,6 +23,13 @@ import { useStrings } from '@ar/frameworks/strings'
 import { useGetSpaceRef, useParentHooks } from '@ar/hooks'
 import DeleteModalContent from '@ar/components/Form/DeleteModalContent'
 
+// Helper function to decode HTML entities
+const decodeHtmlEntities = (text: string): string => {
+  const textarea = document.createElement('textarea')
+  textarea.innerHTML = text
+  return textarea.value
+}
+
 interface useDeleteRepositoryModalProps {
   repoKey: string
   onSuccess: () => void
@@ -36,6 +43,9 @@ export default function useDeleteRepositoryModal(props: useDeleteRepositoryModal
 
   const { mutateAsync: deleteRepository } = useDeleteRegistryMutation()
 
+  // Decode HTML entities to display properly
+  const decodedRepoKey = decodeHtmlEntities(repoKey)
+
   const handleDeleteRepository = async (): Promise<void> => {
     try {
       const response = await deleteRepository({
@@ -60,12 +70,13 @@ export default function useDeleteRepositoryModal(props: useDeleteRepositoryModal
     contentText: (
       <DeleteModalContent
         entity="repository"
-        value={repoKey}
+        value={decodedRepoKey}
         onSubmit={handleDeleteRepository}
         onClose={handleCloseDialog}
         content={getString('repositoryList.deleteModal.contentText')}
         placeholder={getString('repositoryList.deleteModal.inputPlaceholder')}
         inputLabel={getString('repositoryList.deleteModal.inputLabel')}
+        inputLabelValue={decodedRepoKey}
       />
     ),
     customButtons: <></>,
diff --git a/web/src/ar/pages/repository-list/strings/strings.en.yaml b/web/src/ar/pages/repository-list/strings/strings.en.yaml
index f40e452f8d..722d8cfb26 100644
--- a/web/src/ar/pages/repository-list/strings/strings.en.yaml
+++ b/web/src/ar/pages/repository-list/strings/strings.en.yaml
@@ -22,8 +22,8 @@ compact: Compact View
 deleteModal:
   title: '{{ $.artifactList.table.actions.deleteRepository }}'
   contentText: This action will delete registry and all it's images and versions. Are you absolutely sure you want to proceed?
-  inputLabel: Type the registry name or ID to confirm
-  inputPlaceholder: Registry Name or ID
+  inputLabel: Type the registry name to confirm
+  inputPlaceholder: Registry Name
 softDeleteModal:
   title: Archive Registry
   contentText: This action will archive registry and all it's artifacts and versions. You can still restore it from the archived list.
diff --git a/web/src/ar/pages/version-details/components/VersionActions/DeleteVersionMenuItem.tsx b/web/src/ar/pages/version-details/components/VersionActions/DeleteVersionMenuItem.tsx
index 34b6bbaea4..d49b2c224d 100644
--- a/web/src/ar/pages/version-details/components/VersionActions/DeleteVersionMenuItem.tsx
+++ b/web/src/ar/pages/version-details/components/VersionActions/DeleteVersionMenuItem.tsx
@@ -25,7 +25,7 @@ import useDeleteVersionModal from '../../hooks/useDeleteVersionModal'
 import { useUtilsForDeleteVersion } from '../../hooks/useUtilsForDeleteVersion'
 
 export default function DeleteVersionMenuItem(props: VersionActionProps): JSX.Element {
-  const { artifactKey, repoKey, readonly, onClose, versionKey, pageType, data } = props
+  const { artifactKey, repoKey, readonly, onClose, versionKey, pageType, data, digest } = props
   const { getString } = useStrings()
   const { RbacMenuItem } = useParentComponents()
 
@@ -41,6 +41,8 @@ export default function DeleteVersionMenuItem(props: VersionActionProps): JSX.El
     repoKey,
     versionKey,
     artifactType: data?.artifactType,
+    packageType: data?.packageType as any,
+    digest,
     onSuccess: handleAfterDeleteVersion
   })
 
diff --git a/web/src/ar/pages/version-details/hooks/useDeleteVersionModal.tsx b/web/src/ar/pages/version-details/hooks/useDeleteVersionModal.tsx
index 42afd038d0..c47497dd06 100644
--- a/web/src/ar/pages/version-details/hooks/useDeleteVersionModal.tsx
+++ b/web/src/ar/pages/version-details/hooks/useDeleteVersionModal.tsx
@@ -23,22 +23,44 @@ import { useConfirmationDialog, useGetSpaceRef } from '@ar/hooks'
 import { useStrings } from '@ar/frameworks/strings'
 import { encodeRef } from '@ar/hooks/useGetSpaceRef'
 import DeleteModalContent from '@ar/components/Form/DeleteModalContent'
+import { RepositoryPackageType } from '@ar/common/types'
+
+// Helper function to decode HTML entities
+const decodeHtmlEntities = (text: string): string => {
+  const textarea = document.createElement('textarea')
+  textarea.innerHTML = text
+  return textarea.value
+}
 
 interface useDeleteVersionModalProps {
   repoKey: string
   artifactKey: string
   versionKey: string
   artifactType?: ArtifactType
+  packageType?: RepositoryPackageType
+  digest?: string
   onSuccess: () => void
 }
 export default function useDeleteVersionModal(props: useDeleteVersionModalProps) {
-  const { repoKey, onSuccess, artifactKey, versionKey, artifactType } = props
+  const { repoKey, onSuccess, artifactKey, versionKey, artifactType, packageType, digest } = props
   const { getString } = useStrings()
   const { showSuccess, showError, clear } = useToaster()
   const spaceRef = useGetSpaceRef(repoKey)
 
   const { mutateAsync: deleteVersion } = useDeleteArtifactVersionMutation()
 
+  // For OCI packages (Docker/Helm), use digest; for non-OCI packages, use version
+  const isDockerPackage = packageType === RepositoryPackageType.DOCKER
+  const isHelmPackage = packageType === RepositoryPackageType.HELM
+  const isOCIPackage = isDockerPackage || isHelmPackage
+  
+  // Determine which value to use for confirmation
+  const shouldUseDigest = isOCIPackage && digest
+  const confirmationValue = shouldUseDigest ? digest : versionKey
+  
+  // Decode HTML entities to display properly
+  const decodedConfirmationValue = decodeHtmlEntities(confirmationValue)
+
   const handleDeleteVersion = async (): Promise<void> => {
     try {
       const response = await deleteVersion({
@@ -69,12 +91,13 @@ export default function useDeleteVersionModal(props: useDeleteVersionModalProps)
     contentText: (
       <DeleteModalContent
         entity="version"
-        value={versionKey}
+        value={decodedConfirmationValue}
         onSubmit={handleDeleteVersion}
         onClose={handleCloseDialog}
         content={getString('versionDetails.deleteVersionModal.contentText')}
         placeholder={getString('versionDetails.deleteVersionModal.inputPlaceholder')}
         inputLabel={getString('versionDetails.deleteVersionModal.inputLabel')}
+        inputLabelValue={decodedConfirmationValue}
       />
     ),
     customButtons: <></>,

From 125537bb93625e1209dd5d02d0c04c38b46bafbc Mon Sep 17 00:00:00 2001
From: Arham Dugar <arham.dugar@harness.io>
Date: Sun, 22 Feb 2026 20:29:22 +0530
Subject: [PATCH 2/3] Used DOMParser instead of InnerHtml and made it
 extendible

---
 web/src/ar/common/utils.ts                    |  2 +
 web/src/ar/common/utils/decodeHtmlEntities.ts | 40 +++++++++++++++++++
 .../ar/components/Form/DeleteModalContent.tsx |  4 +-
 .../useDeleteArtifactModal.tsx                |  8 +---
 .../useDeleteRepositoryModal.tsx              |  8 +---
 .../hooks/useDeleteVersionModal.tsx           | 12 ++----
 6 files changed, 49 insertions(+), 25 deletions(-)
 create mode 100644 web/src/ar/common/utils/decodeHtmlEntities.ts

diff --git a/web/src/ar/common/utils.ts b/web/src/ar/common/utils.ts
index e170d0fe47..0badecb717 100644
--- a/web/src/ar/common/utils.ts
+++ b/web/src/ar/common/utils.ts
@@ -47,3 +47,5 @@ export function getPackageTypesForApiQueryParams(packageTypes: RepositoryPackage
 export const encodeFileName = (fileName: string): string => {
   return fileName.replace(INVALID_FILENAME_CHARS, '_')
 }
+
+export { decodeHtmlEntities } from './utils/decodeHtmlEntities'
diff --git a/web/src/ar/common/utils/decodeHtmlEntities.ts b/web/src/ar/common/utils/decodeHtmlEntities.ts
new file mode 100644
index 0000000000..3e49b1b4ed
--- /dev/null
+++ b/web/src/ar/common/utils/decodeHtmlEntities.ts
@@ -0,0 +1,40 @@
+/*
+ * Copyright 2024 Harness, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * Safely decodes HTML entities in a string without XSS vulnerability.
+ * Uses DOMParser which is safer than innerHTML as it doesn't execute scripts.
+ *
+ * @param text - The text containing HTML entities to decode
+ * @returns The decoded text with HTML entities converted to their character equivalents
+ *
+ * @example
+ * decodeHtmlEntities('github.com&#x2F;rs&#x2F;xid') // returns 'github.com/rs/xid'
+ * decodeHtmlEntities('&lt;script&gt;alert(1)&lt;/script&gt;') // returns '<script>alert(1)</script>' (safe, no execution)
+ */
+export const decodeHtmlEntities = (text: string): string => {
+  if (!text || typeof text !== 'string') {
+    return text
+  }
+
+  // Use DOMParser which is safer than innerHTML
+  // It parses the content as text/html but doesn't execute scripts
+  const parser = new DOMParser()
+  const doc = parser.parseFromString(text, 'text/html')
+
+  // Extract the text content which automatically decodes entities
+  return doc.documentElement.textContent || text
+}
diff --git a/web/src/ar/components/Form/DeleteModalContent.tsx b/web/src/ar/components/Form/DeleteModalContent.tsx
index 5b49a62168..6a1ce22185 100644
--- a/web/src/ar/components/Form/DeleteModalContent.tsx
+++ b/web/src/ar/components/Form/DeleteModalContent.tsx
@@ -46,10 +46,10 @@ function DeleteModalContent({
   deleteBtnText
 }: DeleteModalContentProps) {
   const { getString } = useStrings()
-  
+
   // Construct the label with the value appended if provided
   const finalLabel = inputLabelValue ? `${inputLabel} (${inputLabelValue})` : inputLabel
-  
+
   return (
     <Formik
       initialValues={{ value: '' }}
diff --git a/web/src/ar/pages/artifact-details/hooks/useDeleteArtifactModal/useDeleteArtifactModal.tsx b/web/src/ar/pages/artifact-details/hooks/useDeleteArtifactModal/useDeleteArtifactModal.tsx
index 656baafc15..6646a62a4d 100644
--- a/web/src/ar/pages/artifact-details/hooks/useDeleteArtifactModal/useDeleteArtifactModal.tsx
+++ b/web/src/ar/pages/artifact-details/hooks/useDeleteArtifactModal/useDeleteArtifactModal.tsx
@@ -23,13 +23,7 @@ import { useGetSpaceRef, useParentHooks } from '@ar/hooks'
 import { useStrings } from '@ar/frameworks/strings'
 import { encodeRef } from '@ar/hooks/useGetSpaceRef'
 import DeleteModalContent from '@ar/components/Form/DeleteModalContent'
-
-// Helper function to decode HTML entities
-const decodeHtmlEntities = (text: string): string => {
-  const textarea = document.createElement('textarea')
-  textarea.innerHTML = text
-  return textarea.value
-}
+import { decodeHtmlEntities } from '@ar/common/utils'
 
 interface useDeleteArtifactModalProps {
   repoKey: string
diff --git a/web/src/ar/pages/repository-details/hooks/useDeleteRepositoryModal/useDeleteRepositoryModal.tsx b/web/src/ar/pages/repository-details/hooks/useDeleteRepositoryModal/useDeleteRepositoryModal.tsx
index 1491179c8a..885d5d16ae 100644
--- a/web/src/ar/pages/repository-details/hooks/useDeleteRepositoryModal/useDeleteRepositoryModal.tsx
+++ b/web/src/ar/pages/repository-details/hooks/useDeleteRepositoryModal/useDeleteRepositoryModal.tsx
@@ -22,13 +22,7 @@ import { useDeleteRegistryMutation } from '@harnessio/react-har-service-client'
 import { useStrings } from '@ar/frameworks/strings'
 import { useGetSpaceRef, useParentHooks } from '@ar/hooks'
 import DeleteModalContent from '@ar/components/Form/DeleteModalContent'
-
-// Helper function to decode HTML entities
-const decodeHtmlEntities = (text: string): string => {
-  const textarea = document.createElement('textarea')
-  textarea.innerHTML = text
-  return textarea.value
-}
+import { decodeHtmlEntities } from '@ar/common/utils'
 
 interface useDeleteRepositoryModalProps {
   repoKey: string
diff --git a/web/src/ar/pages/version-details/hooks/useDeleteVersionModal.tsx b/web/src/ar/pages/version-details/hooks/useDeleteVersionModal.tsx
index c47497dd06..7501521346 100644
--- a/web/src/ar/pages/version-details/hooks/useDeleteVersionModal.tsx
+++ b/web/src/ar/pages/version-details/hooks/useDeleteVersionModal.tsx
@@ -24,13 +24,7 @@ import { useStrings } from '@ar/frameworks/strings'
 import { encodeRef } from '@ar/hooks/useGetSpaceRef'
 import DeleteModalContent from '@ar/components/Form/DeleteModalContent'
 import { RepositoryPackageType } from '@ar/common/types'
-
-// Helper function to decode HTML entities
-const decodeHtmlEntities = (text: string): string => {
-  const textarea = document.createElement('textarea')
-  textarea.innerHTML = text
-  return textarea.value
-}
+import { decodeHtmlEntities } from '@ar/common/utils'
 
 interface useDeleteVersionModalProps {
   repoKey: string
@@ -53,11 +47,11 @@ export default function useDeleteVersionModal(props: useDeleteVersionModalProps)
   const isDockerPackage = packageType === RepositoryPackageType.DOCKER
   const isHelmPackage = packageType === RepositoryPackageType.HELM
   const isOCIPackage = isDockerPackage || isHelmPackage
-  
+
   // Determine which value to use for confirmation
   const shouldUseDigest = isOCIPackage && digest
   const confirmationValue = shouldUseDigest ? digest : versionKey
-  
+
   // Decode HTML entities to display properly
   const decodedConfirmationValue = decodeHtmlEntities(confirmationValue)
 

From bec1dd7385db232e24fc4d25f197642e16d170a4 Mon Sep 17 00:00:00 2001
From: Arham Dugar <arham.dugar@harness.io>
Date: Sun, 22 Feb 2026 20:46:19 +0530
Subject: [PATCH 3/3] repository enum type added for packagetype

---
 .../components/VersionActions/DeleteVersionMenuItem.tsx        | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/web/src/ar/pages/version-details/components/VersionActions/DeleteVersionMenuItem.tsx b/web/src/ar/pages/version-details/components/VersionActions/DeleteVersionMenuItem.tsx
index d49b2c224d..d04709794f 100644
--- a/web/src/ar/pages/version-details/components/VersionActions/DeleteVersionMenuItem.tsx
+++ b/web/src/ar/pages/version-details/components/VersionActions/DeleteVersionMenuItem.tsx
@@ -19,6 +19,7 @@ import React from 'react'
 import { useStrings } from '@ar/frameworks/strings'
 import { useParentComponents } from '@ar/hooks'
 import { PermissionIdentifier, ResourceType } from '@ar/common/permissionTypes'
+import type { RepositoryPackageType } from '@ar/common/types'
 
 import type { VersionActionProps } from './types'
 import useDeleteVersionModal from '../../hooks/useDeleteVersionModal'
@@ -41,7 +42,7 @@ export default function DeleteVersionMenuItem(props: VersionActionProps): JSX.El
     repoKey,
     versionKey,
     artifactType: data?.artifactType,
-    packageType: data?.packageType as any,
+    packageType: data?.packageType as RepositoryPackageType,
     digest,
     onSuccess: handleAfterDeleteVersion
   })