fix(web): harden legal script sanitization

[kilo-code-bot]

Summary

• Fixes CodeQL alert 430 by repeatedly removing legal-page <script> elements until malformed nested tags can no longer reintroduce a script tag.
• Adds a regression case for malformed nested script markup in imported legal content.

Verification

• Confirmed a malformed nested script sample is reduced to inert legal-page HTML with the expected body content.
• Targeted Jest coverage was not completed because this container has no Docker binary to start the required test Postgres service.

Visual Changes

N/A

Reviewer Notes

• Scope is intentionally limited to the script sanitization path flagged by CodeQL alert 430.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Executive Summary

The iterative script-tag removal loop correctly addresses the nested-tag bypass (CodeQL alert 430) and terminates safely — no bugs, security regressions, or performance concerns found in the two changed files.

Files Reviewed (2 files)

• apps/web/src/app/legal-page-source.ts
• apps/web/src/app/terms-app/terms-source.test.ts

---

Loop correctness: Each iteration of the do…while in removeScriptElements replaces matches with '', so the string strictly shrinks whenever a match is found. The loop terminates when no further matches are found (sanitizedHtml === previousHtml). No infinite loop is possible.

Attack vector coverage: The regression test correctly exercises the bypass: <scrip<script>alert('removed')</script>t>alert('xss')</script> — first pass strips the inner <script>alert('removed')</script>, reassembling <script>alert('xss')</script>, which the second pass removes entirely. Both <script and alert( are correctly absent from the result.

Scope: iframe and on* removal are not looped, but these are not subject to the same nested-tag reconstruction attack and are pre-existing — outside this PR's stated scope.

Fix these issues in Kilo Cloud

---

_{Reviewed by claude-4.6-sonnet-20260217 · 392,843 tokens}

_{Review guidance: REVIEW.md from base branch main}