From cc8aab9eb0e5f6af6fe20f222e23b5fae3aa3851 Mon Sep 17 00:00:00 2001
From: msukkari <michael.sukkarieh@mail.mcgill.ca>
Date: Wed, 3 Jun 2026 16:45:31 -0700
Subject: [PATCH] fix(web): strip HTML tags iteratively in MCP tool metadata
 sanitizer

A single replace pass over `<[^>]*>` can reintroduce a tag sequence
(e.g. "<scr<x>ipt>" collapses to "<script>"), flagged by CodeQL
js/incomplete-multi-character-sanitization. Loop until stable.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .../web/src/ee/features/chat/mcp/mcpToolMetadata.ts   | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/packages/web/src/ee/features/chat/mcp/mcpToolMetadata.ts b/packages/web/src/ee/features/chat/mcp/mcpToolMetadata.ts
index bbeb71c84..d6a81db81 100644
--- a/packages/web/src/ee/features/chat/mcp/mcpToolMetadata.ts
+++ b/packages/web/src/ee/features/chat/mcp/mcpToolMetadata.ts
@@ -40,7 +40,16 @@ function removeControlCharacters(value: string): string {
 }
 
 function removeHtmlTags(value: string): string {
-    return value.replace(/<[^>]*>/g, '');
+    // Strip repeatedly until stable: a single pass can reintroduce a tag
+    // sequence (e.g. "<scr<x>ipt>" collapses to "<script>"), so loop until
+    // no more tags are removed.
+    let current = value;
+    let previous: string;
+    do {
+        previous = current;
+        current = current.replace(/<[^>]*>/g, '');
+    } while (current !== previous);
+    return current;
 }
 
 function normalizeWhitespace(value: string): string {