From f5cf05789af57d78261f48f17aa5de8866f434ea Mon Sep 17 00:00:00 2001
From: kanywst <niwatakuma@icloud.com>
Date: Sun, 25 Oct 2026 00:46:56 +0900
Subject: [PATCH 1/2] fix(readme): strip link-text markup to a fixed point

CodeQL (js/incomplete-multi-character-sanitization) flagged the single-pass tag
strip: '<scr<b>ipt>' left '<script' behind. The text was only ever rendered as
text, but it now reads as plain text too, with no angle brackets left.
---
 src/lib/readme.test.ts |  8 ++++++++
 src/lib/readme.ts      | 13 ++++++++++++-
 2 files changed, 20 insertions(+), 1 deletion(-)

diff --git a/src/lib/readme.test.ts b/src/lib/readme.test.ts
index c653dfb..9308c8c 100644
--- a/src/lib/readme.test.ts
+++ b/src/lib/readme.test.ts
@@ -71,6 +71,14 @@ describe("parseBlocks", () => {
     expect(p).toEqual({ kind: "text", segs: [{ text: "it's 'fine' &#39; &lt;b&gt;" }] });
   });
 
+  it("leaves no markup behind in link text, even when tags are nested to dodge one pass", () => {
+    const [p] = parseBlocks(`<p><a href="${ISSUE}"><scr<b>ipt>alert(1)<b>y</b></a></p>`);
+    if (p.kind !== "text") throw new Error("expected text");
+    expect(p.segs).toHaveLength(1);
+    expect(p.segs[0].text).not.toMatch(/[<>]/);
+    expect(p.segs[0].text).toContain("alert(1)y");
+  });
+
   it("survives references that name no real character", () => {
     const [p] = parseBlocks("<p>a&#x110000;b&#xD800;c&#0;d&bogus;e</p>");
     expect(p).toEqual({ kind: "text", segs: [{ text: "a\ufffdb\ufffdc\ufffdd&bogus;e" }] });
diff --git a/src/lib/readme.ts b/src/lib/readme.ts
index bade5eb..1e71399 100644
--- a/src/lib/readme.ts
+++ b/src/lib/readme.ts
@@ -54,12 +54,23 @@ function decode(s: string): string {
   });
 }
 
+// Removes markup until none is left: one pass over "<scr<b>ipt>" would leave "<script>".
+// The result is only ever rendered as text, but it should also read as plain text.
+function stripTags(html: string): string {
+  let out = html;
+  for (let prev = ""; prev !== out; ) {
+    prev = out;
+    out = out.replace(/<[^>]*>/g, "");
+  }
+  return out.replace(/[<>]/g, "");
+}
+
 function segments(html: string): Seg[] {
   const segs: Seg[] = [];
   const re = /<a\s+href="([^"]+)"[^>]*>([\s\S]*?)<\/a>|<[^>]+>|([^<]+)/g;
   for (const m of html.matchAll(re)) {
     if (m[1] !== undefined) {
-      const text = decode(m[2].replace(/<[^>]+>/g, "")).trim();
+      const text = decode(stripTags(m[2])).trim();
       const href = safeHref(m[1]);
       if (text) segs.push(href ? { text, href } : { text });
     } else if (m[3] !== undefined) {

From 099dc0bf94e8fe0ffdf58ab0526ec90a9ea343e7 Mon Sep 17 00:00:00 2001
From: kanywst <niwatakuma@icloud.com>
Date: Sun, 25 Oct 2026 00:50:05 +0900
Subject: [PATCH 2/2] docs(readme): say what stripTags does and doesn't promise

---
 src/lib/readme.ts | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/lib/readme.ts b/src/lib/readme.ts
index 1e71399..e2dc86a 100644
--- a/src/lib/readme.ts
+++ b/src/lib/readme.ts
@@ -55,7 +55,8 @@ function decode(s: string): string {
 }
 
 // Removes markup until none is left: one pass over "<scr<b>ipt>" would leave "<script>".
-// The result is only ever rendered as text, but it should also read as plain text.
+// The result is only ever rendered as text. Entities are decoded afterwards on purpose, so a
+// README that writes "&lt;b&gt;" still shows the literal text "<b>".
 function stripTags(html: string): string {
   let out = html;
   for (let prev = ""; prev !== out; ) {