| 286 | // unterminated "<!--" (CodeQL js/polynomial-redos). An unterminated "<!--" with |
| 287 | // no closing "-->" is kept verbatim, matching the prior regex's no-match behavior. |
| 288 | function stripHtmlCommentsOnce(source: string): string { |
| 289 | let out = ""; |
| 290 | let i = 0; |
| 291 | for (;;) { |
| 292 | const start = source.indexOf("<!--", i); |
| 293 | if (start < 0) return out + source.slice(i); |
| 294 | const end = source.indexOf("-->", start + 4); |
| 295 | if (end < 0) return out + source.slice(i); |
| 296 | out += source.slice(i, start); |
| 297 | i = end + 3; |
| 298 | } |
| 299 | } |
| 300 | |
| 301 | // Strip HTML comments to a fixpoint. A single pass is not enough: deleting one |
| 302 | // comment can splice adjacent markers into a fresh, complete <!-- … --> (e.g. |