Function stripAndEscapeHtml

app/composables/useMarkdown.ts:45–72

(text: string)

// Strip HTML tags and escape remaining HTML to prevent XSS
function stripAndEscapeHtml(text: string): string {
  // First decode any HTML entities in the input
  let stripped = decodeHtmlEntities(text)

  // Then strip markdown image badges
  stripped = stripMarkdownImages(stripped)

  // Strip actual HTML tags (keep their text content), but leave tags inside backtick spans
  // The alternation matches a backtick span first — if that branch wins the match is kept as-is
  stripped = stripped.replace(
    /(`[^`]*`)|<\/?[a-z][^>]*>/gi,
    (match, codeSpan: string | undefined) => codeSpan ?? '',
  )

  // Strip HTML comments: <!-- ... --> (including unclosed comments from truncation)
  stripped = stripped.replace(
    /(`[^`]*`)|<!--[\s\S]*?(-->|$)/g,
    (match, codeSpan: string | undefined) => codeSpan ?? '',
  )

  // Then escape any remaining HTML entities
  return stripped
    .replace(/&/g, '&amp;')
    .replace(/</g, '&lt;')
    .replace(/>/g, '&gt;')
    .replace(/"/g, '&quot;')
    .replace(/'/g, '&#039;')
}

// Parse simple inline markdown to HTML
function parseMarkdown({ text, plain }: UseMarkdownOptions): string {