Merge pull request #47 from agent-ecosystem/fix/strip-code-follow-up

dacharyc · web-flow · commit 4498afe272ad · 2026-04-19T11:41:39.000-04:00
fix: address truncation risk in stripCode across slice boundaries
diff --git a/src/helpers/detect-markdown.ts b/src/helpers/detect-markdown.ts
@@ -23,7 +23,7 @@ function stripCode(text: string): string {
  * from markdown that mentions HTML tags in code examples.
  */
 export function looksLikeHtml(body: string): boolean {
-  const sample = stripCode(body.slice(0, 2000));
+  const sample = stripCode(body).slice(0, 2000);
   return HTML_PATTERNS.some((p) => p.test(sample));
 }
 
diff --git a/test/unit/helpers/detect-markdown.test.ts b/test/unit/helpers/detect-markdown.test.ts
@@ -42,6 +42,12 @@ describe('looksLikeHtml', () => {
     expect(looksLikeHtml(md)).toBe(false);
   });
 
+  it('ignores HTML in code blocks longer than 2000 characters', () => {
+    const md =
+      '# Setup\n\n```html\n<html>\n<body>\n' + 'x'.repeat(3000) + '\n</body>\n</html>\n```\n';
+    expect(looksLikeHtml(md)).toBe(false);
+  });
+
   it('still detects real HTML outside of code blocks', () => {
     const html = '<!DOCTYPE html>\n<html>\n```not a code block\n```\n</html>';
     expect(looksLikeHtml(html)).toBe(true);

Original file line number	Diff line number	Diff line change
`@@ -23,7 +23,7 @@ function stripCode(text: string): string {`
`23`	`23`	`* from markdown that mentions HTML tags in code examples.`
`24`	`24`	`*/`
`25`	`25`	`export function looksLikeHtml(body: string): boolean {`
`26`		`- const sample = stripCode(body.slice(0, 2000));`
	`26`	`+ const sample = stripCode(body).slice(0, 2000);`
`27`	`27`	`return HTML_PATTERNS.some((p) => p.test(sample));`
`28`	`28`	`}`
`29`	`29`