fix(desktop): bound HTML comment scanning (#11406)

Signed-off-by: Jasper Hugo <jasper@spiral.xyz>

ui/desktop/src/utils/htmlSecurity.test.ts

@@ -1,4 +1,5 @@
 import { describe, it, expect } from 'vitest';
+import { performance } from 'node:perf_hooks';
 import { containsHTML, wrapHTMLInCodeBlock } from '../utils/htmlSecurity';
 
 describe('HTML Security Detection', () => {
@@ -93,6 +94,15 @@ describe('HTML Security Detection', () => {
         expect(containsHTML('<>')).toBe(false);
         expect(containsHTML('< div >')).toBe(false);
       });
+
+      it('rejects unterminated comment prefixes without blocking the renderer', () => {
+        const maliciousContent = '<!--'.repeat(64_000);
+        const startedAt = performance.now();
+
+        expect(containsHTML(maliciousContent)).toBe(false);
+
+        expect(performance.now() - startedAt).toBeLessThan(750);
+      }, 10_000);
     });
   });
 

ui/desktop/src/utils/htmlSecurity.ts

@@ -15,8 +15,9 @@ export function containsHTML(str: string): boolean {
   const withoutCodeBlocks = str.replace(/```[\s\S]*?```/g, '').replace(/`[^`]*`/g, '');
 
   // Check for HTML comments first
-  const commentRegex = /<!--[\s\S]*?-->/;
-  const hasComments = commentRegex.test(withoutCodeBlocks);
+  const commentStart = withoutCodeBlocks.indexOf('<!--');
+  const hasComments =
+    commentStart !== -1 && withoutCodeBlocks.indexOf('-->', commentStart + 4) !== -1;
 
   // Only detect potentially dangerous HTML tags that could execute or affect layout
   const dangerousHTMLRegex =