From 7c4a76d0d74457e4348f0715cd87501a11328046 Mon Sep 17 00:00:00 2001
From: Prathamesh Penshanwar <128643250+PRATHAM777P@users.noreply.github.com>
Date: Mon, 27 Apr 2026 23:45:37 +0530
Subject: [PATCH] Potential fix for code scanning alert no. 3: Incomplete
 multi-character sanitization

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
---
 src/tools/fetch/web-fetch-utils.ts | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/src/tools/fetch/web-fetch-utils.ts b/src/tools/fetch/web-fetch-utils.ts
index 39448c1..f1c8842 100644
--- a/src/tools/fetch/web-fetch-utils.ts
+++ b/src/tools/fetch/web-fetch-utils.ts
@@ -35,10 +35,15 @@ function normalizeWhitespace(value: string): string {
 export function htmlToMarkdown(html: string): { text: string; title?: string } {
   const titleMatch = html.match(/<title[^>]*>([\s\S]*?)<\/title>/i);
   const title = titleMatch ? normalizeWhitespace(stripTags(titleMatch[1])) : undefined;
-  let text = html
-    .replace(/<script[\s\S]*?<\/script>/gi, "")
-    .replace(/<style[\s\S]*?<\/style>/gi, "")
-    .replace(/<noscript[\s\S]*?<\/noscript>/gi, "");
+  let text = html;
+  let previous: string;
+  do {
+    previous = text;
+    text = text
+      .replace(/<script[\s\S]*?<\/script>/gi, "")
+      .replace(/<style[\s\S]*?<\/style>/gi, "")
+      .replace(/<noscript[\s\S]*?<\/noscript>/gi, "");
+  } while (text !== previous);
   text = text.replace(/<a\s+[^>]*href=["']([^"']+)["'][^>]*>([\s\S]*?)<\/a>/gi, (_, href, body) => {
     const label = normalizeWhitespace(stripTags(body));
     if (!label) {