Potential fix for code scanning alert no. 5: Incomplete multi-character sanitization

[CheFu-code]

Potential fix for https://github.com/CheFu-code/flow/security/code-scanning/5

Use iterative sanitization for the multi-character unsafe patterns before allowlist rewriting.

Best fix in this file:

• In sanitizeReaderHtml (around lines 159–166), replace the current one-pass chained .replace(...) sequence with:
  1. Initial extraction (extractBody(value)).
  2. A loop that repeatedly removes doctype, head blocks, unsafe paired tags, unsafe self-closing tags, and comments.
  3. Stop when the string no longer changes.
• Keep the existing allowlist/tag reconstruction logic unchanged (lines 167+), so functionality remains the same while closing the incomplete-sanitization gap.

No new imports or dependencies are required.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

Summary by CodeRabbit

• Refactor
  • Strengthened HTML sanitization logic to provide more thorough cleanup of potentially unsafe content through an iterative approach.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
flow	Ready	Preview, Comment	Jun 19, 2026 3:44pm

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 7978a1e9-bb59-4fd7-9788-6756bff374e7

📥 Commits

Reviewing files that changed from the base of the PR and between 769e053 and 0fc6668.

📒 Files selected for processing (1)

• src/lib/flow-console/reader.ts

---

📝 Walkthrough

Walkthrough

In sanitizeReaderHtml, the initial sanitization of body is changed from a single-pass chain of .replace() calls to a do...while loop that re-applies all five regex-based removals (doctype, head block, unsafe tags, unsafe self-closing tags, HTML comments) repeatedly until the content stabilizes.

Changes

Iterative HTML Sanitization

Layer / File(s)	Summary
Iterative do...while sanitization loop src/lib/flow-console/reader.ts	body is initialized from extractBody(value) and then all five regex removal steps are applied in a do...while loop, iterating until no further changes occur, replacing the previous single-pass const body assignment.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~5 minutes

Poem

A rabbit checks the HTML twice,
Then loops again to make it nice,
No sneaky tags shall slip between,
Each pass scrubs everything unseen,
Until the hutch is tidy and clean! 🐇✨

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch alert-autofix-5

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}