From 6e4d451a10582606c34095edab85b83bcb26d76a Mon Sep 17 00:00:00 2001
From: SatoshiQaziMuhammed <info@pezkuwichain.io>
Date: Wed, 21 Oct 2026 13:38:53 +0400
Subject: [PATCH] fix(ui): remove tags until none are left in sanitizeHtml
 (#17)

#16 added a final angle-bracket strip, which made the output safe, but the single-pass tag removal before it is still what CodeQL flags (js/incomplete-multi-character-sanitization #6, #24): the analysis does not credit the later strip. Tag removal now repeats until the string stops changing, the stray-bracket strip stays, and the allowLineBreaks branch no longer discards the earlier pass by restarting from the raw input.
---
 .../extension-ui/src/util/sanitizeOrigin.ts   | 26 +++++++++----------
 1 file changed, 13 insertions(+), 13 deletions(-)

diff --git a/packages/extension-ui/src/util/sanitizeOrigin.ts b/packages/extension-ui/src/util/sanitizeOrigin.ts
index c48e0c1..1172935 100644
--- a/packages/extension-ui/src/util/sanitizeOrigin.ts
+++ b/packages/extension-ui/src/util/sanitizeOrigin.ts
@@ -9,22 +9,22 @@ const sanitizeHtml = (input: string, options?: {
     return '';
   }
 
-  let sanitized = input;
+  // <br> becomes a line break only when asked for; everything else that looks
+  // like markup is removed below.
+  let sanitized = options?.allowLineBreaks
+    ? input.replace(/<br\s*\/?>/gi, '\n')
+    : input;
 
-  // Remove all HTML tags
-  sanitized = sanitized.replace(/<[^>]*>/g, '');
+  // One pass of tag removal turns `<scr<script>ipt>` into a new `<script`, so
+  // repeat until nothing changes, then drop any stray angle bracket: an origin
+  // never contains one, and validateOrigin treats them as suspicious.
+  let previous: string;
 
-  // Handle line breaks if specified
-  if (options?.allowLineBreaks) {
-    // Convert <br> to actual line breaks before sanitization
-    sanitized = input
-      .replace(/<br\s*\/?>/gi, '\n')
-      .replace(/<[^>]*>/g, ''); // Remove other HTML tags
-  }
+  do {
+    previous = sanitized;
+    sanitized = sanitized.replace(/<[^>]*>/g, '');
+  } while (sanitized !== previous);
 
-  // Tag removal is a single pass, so nested input such as `<scr<script>ipt>`
-  // leaves a new tag behind. Drop every remaining angle bracket; an origin never
-  // contains one, and validateOrigin already treats them as suspicious.
   sanitized = sanitized.replace(/[<>]/g, '');
 
   // Normalize whitespace