[hyperpolymath]

What this changes

Both open code-scanning alerts — 4 and 5 — are the same rule, js/incomplete-multi-character-sanitization (high, CWE-020/080/116), on the same shape: text.replace(/<[^>]+>/g, '') stripping the pseudo-HTML markup Plotly accepts in titles. A single pass is not a sanitizer: in "<scr<script>ipt>" the inner tag is removed and the halves join into a fresh <script>.

The strip now lives in one shared helper, stripHtmlTags in frontend/src/utils/text.ts, which repeats the replacement until the text stops changing — CodeQL's documented remedy, and a fixpoint by construction. It is used at both flagged sites:

• frontend/src/figure/charts.ts — the pane title width measurement (alert 5),
• frontend/src/components/AnalysisChart.tsx — the report figure's default title (alert 4).

Behaviour on ordinary titles is identical

Titles like CO<sub>2</sub> or <b>run</b> come out exactly as before: the second pass finds nothing and changes nothing. Bare > in a title ("p > 0.05") is untouched, as it always was.

Tests

New frontend/src/utils/text.test.ts pins the split-tag case (<scr<script>ipt>... leaves no complete tag), normal markup, and unchanged plain text. Run them with, from frontend/:

bun run test
bun run typecheck

Both pass locally, as does bun run build (tsc && vite build): 42/42 tests across 7 files.

What this leaves out

No other sanitization sites exist in the frontend (grep '<\[^>]' frontend/src finds only these two), no dependency is added (the alternative, sanitize-html, is not needed for stripping markup from plain title text), and nothing outside the frontend is touched. The branch is a single commit off the current main tip.

Versions tested

bun 1.4.3 (the local mise shim; CI installs the version pinned in config/defaults/tool_versions.yml). Julia and R are untouched by this change.

Note: this commit is unsigned — the signing key's passphrase was not available in the session that produced it. Amend/rebase to sign if the fork's history requires it.

---

Generated by Mistral Vibe.
Co-Authored-By: Mistral Vibe vibe@mistral.ai

[coderabbitai]

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 97f5f6ab-c90e-4b0d-b75e-abae32c06aa2

📥 Commits

Reviewing files that changed from the base of the PR and between 17fef94 and dbfef5b.

📒 Files selected for processing: 4

• frontend/src/components/AnalysisChart.tsx
• frontend/src/figure/charts.ts
• frontend/src/utils/text.test.ts
• frontend/src/utils/text.ts

 _____________________________
< I speak fluent stack trace. >
 -----------------------------
  \
   \   \
        \ /\
        ( )
      .( o ).

✨ Finishing Touches: 💡 1

📝 Generate docstrings: 💡

• 🔴 Error committing to branch - (🔄 Check to retry)
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
1 New issue
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[coderabbitai]

❌ Failed to create Coding Agent finishing-touch task. Please try again.