From 0fc6668bd23f1eada2a18254578f8e26a0361aff Mon Sep 17 00:00:00 2001
From: CheFu <kurisanimaluleke77@gmail.com>
Date: Fri, 19 Jun 2026 17:43:48 +0200
Subject: [PATCH] Potential fix for code scanning alert no. 5: Incomplete
 multi-character sanitization

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
---
 src/lib/flow-console/reader.ts | 18 ++++++++++++------
 1 file changed, 12 insertions(+), 6 deletions(-)

diff --git a/src/lib/flow-console/reader.ts b/src/lib/flow-console/reader.ts
index da0054b..7ad8fc8 100644
--- a/src/lib/flow-console/reader.ts
+++ b/src/lib/flow-console/reader.ts
@@ -157,12 +157,18 @@ export function renderReaderPrintDocument(thread: MailThread) {
 }
 
 function sanitizeReaderHtml(value: string) {
-  const body = extractBody(value)
-    .replace(/<!doctype[^>]*>/gi, '')
-    .replace(/<head[^>]*>[\s\S]*?<\/head>/gi, '')
-    .replace(unsafeTagPattern, '')
-    .replace(unsafeSelfClosingTagPattern, '')
-    .replace(/<!--[\s\S]*?-->/g, '');
+  let body = extractBody(value);
+  let previous: string;
+
+  do {
+    previous = body;
+    body = body
+      .replace(/<!doctype[^>]*>/gi, '')
+      .replace(/<head[^>]*>[\s\S]*?<\/head>/gi, '')
+      .replace(unsafeTagPattern, '')
+      .replace(unsafeSelfClosingTagPattern, '')
+      .replace(/<!--[\s\S]*?-->/g, '');
+  } while (body !== previous);
 
   return body.replace(tagPattern, (match, tagName, rawAttributes) => {
     const tag = String(tagName).toLowerCase();