mirror of
https://github.com/pezkuwichain/pezkuwi-extension.git
synced 2026-10-28 06:19:49 +00:00
#16 added a final angle-bracket strip, which made the output safe, but the single-pass tag removal before it is still what CodeQL flags (js/incomplete-multi-character-sanitization #6, #24): the analysis does not credit the later strip. Tag removal now repeats until the string stops changing, the stray-bracket strip stays, and the allowLineBreaks branch no longer discards the earlier pass by restarting from the raw input.