From 5611772e2afe0e4da14350f13451886641e2c6f0 Mon Sep 17 00:00:00 2001
From: Prathamesh Penshanwar <128643250+PRATHAM777P@users.noreply.github.com>
Date: Mon, 27 Apr 2026 23:39:45 +0530
Subject: [PATCH] Potential fix for code scanning alert no. 1: Incomplete
 multi-character sanitization

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
---
 src/tools/fetch/web-fetch-utils.ts | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/src/tools/fetch/web-fetch-utils.ts b/src/tools/fetch/web-fetch-utils.ts
index 5e0a248..39448c1 100644
--- a/src/tools/fetch/web-fetch-utils.ts
+++ b/src/tools/fetch/web-fetch-utils.ts
@@ -13,7 +13,14 @@ function decodeEntities(value: string): string {
 }
 
 function stripTags(value: string): string {
-  return decodeEntities(value.replace(/<[^>]+>/g, ""));
+  let current = value;
+  let previous: string;
+  do {
+    previous = current;
+    current = current.replace(/<[^>]+>/g, "");
+  } while (current !== previous);
+
+  return decodeEntities(current).replace(/[<>]/g, "");
 }
 
 function normalizeWhitespace(value: string): string {