From b4bf41a6046748a813f88f6e69000003898012f1 Mon Sep 17 00:00:00 2001
From: Leon van Zantvoort <zantvoort@beatgridmedia.com>
Date: Sun, 12 Jul 2026 12:27:41 +0200
Subject: [PATCH] fix(website): strip tags to a fixed point in the copy-text
 helper

CodeQL js/incomplete-multi-character-sanitization on the tutorial
editor's toPlain helper: a single tag-stripping pass is not idempotent,
because removing an inner tag can splice two fragments into a fresh tag
(<scr<span></span>ipt> collapses to <script>). Repeat the strip until
the markup stops changing before unescaping.

The input is trusted build-time highlight markup and the result is
escaped before it reaches the data-copy attribute and only used as
clipboard text, so this was not an exploitable sink; the fix clears the
alert and removes the non-idempotent pattern.
---
 website/src/components/tutorial/tutorialTheme.js | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/website/src/components/tutorial/tutorialTheme.js b/website/src/components/tutorial/tutorialTheme.js
index 2ea9b4017..475fcc19e 100644
--- a/website/src/components/tutorial/tutorialTheme.js
+++ b/website/src/components/tutorial/tutorialTheme.js
@@ -70,8 +70,17 @@ export const DATABASE_VARIANTS = [
 export function editor({file, tag, code, sql, copy, variants}) {
   // The highlighted HTML is entirely esc()'d text inside spans, so dropping
   // the tags and unescaping recovers the source text exactly.
-  const toPlain = (html) =>
-    html.replace(/<[^>]+>/g, '').replace(/&lt;/g, '<').replace(/&gt;/g, '>').replace(/&amp;/g, '&');
+  const toPlain = (html) => {
+    // Strip tags to a fixed point before unescaping: a single pass is not idempotent, since removing an
+    // inner tag can splice two fragments into a fresh tag, so repeat until the markup stops changing.
+    let stripped = html;
+    let previous;
+    do {
+      previous = stripped;
+      stripped = stripped.replace(/<[^>]+>/g, '');
+    } while (stripped !== previous);
+    return stripped.replace(/&lt;/g, '<').replace(/&gt;/g, '>').replace(/&amp;/g, '&');
+  };
   // Newlines only occur in the escaped text tokens, never inside tag markup,
   // so the line count can be taken from the HTML string directly.
   const pane = (html) => {