From dbfef5b5365004c339fc2b8efa450e6aec1b9839 Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <j.d.a.jewell@open.ac.uk>
Date: Thu, 15 Oct 2026 00:33:15 +0100
Subject: [PATCH] fix(charts): strip title markup to a fixpoint, not one pass
 (code-scanning 4, 5)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Both open code-scanning alerts are the same rule,
js/incomplete-multi-character-sanitization (CWE-020/080/116, high), on
the same shape: text.replace(/<[^>]+>/g, '') stripping the pseudo-HTML
Plotly accepts in titles. One pass can reintroduce the dangerous
sequence — "<scr<script>ipt>" loses its inner tag and the halves join
into a fresh "<script>" — so the strip now lives in one shared helper,
stripHtmlTags in utils/text.ts, and repeats until the text stops
changing. Behaviour on ordinary titles (CO<sub>2</sub>, <b>, <br>) is
identical: the second pass finds nothing and changes nothing.

Used at both flagged sites — the pane title width measurement in
figure/charts.ts and the report figure title in components/AnalysisChart.tsx
— and pinned by new tests in utils/text.test.ts covering the split-tag
case, normal markup, and bare ">" text.

Generated by Mistral Vibe.
Co-Authored-By: Mistral Vibe <vibe@mistral.ai>
---
 frontend/src/components/AnalysisChart.tsx |  3 ++-
 frontend/src/figure/charts.ts             |  3 ++-
 frontend/src/utils/text.test.ts           | 24 +++++++++++++++++++++++
 frontend/src/utils/text.ts                | 17 ++++++++++++++++
 4 files changed, 45 insertions(+), 2 deletions(-)
 create mode 100644 frontend/src/utils/text.test.ts

diff --git a/frontend/src/components/AnalysisChart.tsx b/frontend/src/components/AnalysisChart.tsx
index 3e40f157..17e8a437 100644
--- a/frontend/src/components/AnalysisChart.tsx
+++ b/frontend/src/components/AnalysisChart.tsx
@@ -1,13 +1,14 @@
 // © 2026 Joshua Benjamin Jewell. All rights reserved.
 // Licensed under the GNU Affero General Public License version 3 (AGPLv3).
 import Plotly from 'plotly.js-dist-min'
+import { stripHtmlTags } from '../utils/text'
 import { AddToReport } from './AddToReport'
 import { PlotlyChart } from './PlotlyChart'
 
 const figureTitle = (fig: unknown): string | null => {
   const t = (fig as { layout?: { title?: unknown } })?.layout?.title
   const text = typeof t === 'string' ? t : (t as { text?: string } | undefined)?.text
-  return text ? text.replace(/<[^>]+>/g, '') : null
+  return text ? stripHtmlTags(text) : null
 }
 
 // The chart as standalone SVG, at a fixed print width.
diff --git a/frontend/src/figure/charts.ts b/frontend/src/figure/charts.ts
index 29845147..6ee30a69 100644
--- a/frontend/src/figure/charts.ts
+++ b/frontend/src/figure/charts.ts
@@ -2,6 +2,7 @@
 // Licensed under the GNU Affero General Public License version 3 (AGPLv3).
 import { api } from '../api/client'
 import { extractAlphaPanel } from '../components/alphaMetrics'
+import { stripHtmlTags } from '../utils/text'
 import { textWidth } from './legend'
 import { PX_PER_PT, tickPt, titlePt, type AlphaMetricKey, type ChartSpec, type FigureDoc, type FigurePane } from './types'
 
@@ -119,7 +120,7 @@ export function paneFigure(raw: unknown, pane: FigurePane, doc: FigureDoc, opts:
   // A title wider than its pane shrinks to fit, clear of the group letter.
   const titleRoom = opts.widthPx - 2 * doc.letters.sizePt * PX_PER_PT
   const titleSize = Math.min(titlePt(doc) * PX_PER_PT,
-    titlePt(doc) * PX_PER_PT * titleRoom / Math.max(1, textWidth(title.replace(/<[^>]+>/g, ''), titlePt(doc) * PX_PER_PT, family)))
+    titlePt(doc) * PX_PER_PT * titleRoom / Math.max(1, textWidth(stripHtmlTags(title), titlePt(doc) * PX_PER_PT, family)))
 
   for (const k of axisKeys(L, 'x').concat(axisKeys(L, 'y'))) {
     const ax = { ...(L[k] as Record<string, unknown>) }
diff --git a/frontend/src/utils/text.test.ts b/frontend/src/utils/text.test.ts
new file mode 100644
index 00000000..f5ed71b9
--- /dev/null
+++ b/frontend/src/utils/text.test.ts
@@ -0,0 +1,24 @@
+// © 2026 Joshua Benjamin Jewell. All rights reserved.
+// Licensed under the GNU Affero General Public License version 3 (AGPLv3).
+import { describe, expect, test } from 'bun:test'
+import { splitLines, stripHtmlTags } from './text'
+
+describe('stripHtmlTags', () => {
+  test('removes the markup Plotly allows in a title', () => {
+    expect(stripHtmlTags('CO<sub>2</sub> by <b>run</b>')).toBe('CO2 by run')
+  })
+
+  test('a tag hiding inside another does not survive', () => {
+    expect(stripHtmlTags('<scr<script>ipt>alert(1)</script>')).not.toMatch(/<[^>]+>/)
+  })
+
+  test('text without markup, including a bare >, is unchanged', () => {
+    expect(stripHtmlTags('p > 0.05 for all')).toBe('p > 0.05 for all')
+  })
+})
+
+describe('splitLines', () => {
+  test('one trimmed value per line, blanks dropped', () => {
+    expect(splitLines(' a\n\n b \nc')).toEqual(['a', 'b', 'c'])
+  })
+})
diff --git a/frontend/src/utils/text.ts b/frontend/src/utils/text.ts
index dc076655..ffdecc9c 100644
--- a/frontend/src/utils/text.ts
+++ b/frontend/src/utils/text.ts
@@ -9,3 +9,20 @@
 export function splitLines(text: string): string[] {
   return text.split('\n').map(v => v.trim()).filter(v => v.length > 0)
 }
+
+/**
+ * Strip the pseudo-HTML markup Plotly accepts in titles and axis labels (<b>,
+ * <br>, <sub> and friends), leaving the bare text for measuring or for a
+ * filename. A single pass is not enough: replacing "<scr<script>ipt>" once
+ * removes the inner tag and leaves the halves joined into another, so the
+ * strip repeats until the text stops changing.
+ */
+export function stripHtmlTags(text: string): string {
+  let stripped = text
+  let previous = ''
+  do {
+    previous = stripped
+    stripped = stripped.replace(/<[^>]+>/g, '')
+  } while (stripped !== previous)
+  return stripped
+}