From 8a1b836ceb7a2fe7ebd088da34076c44ad709274 Mon Sep 17 00:00:00 2001
From: Jasper <jasper@spiral.xyz>
Date: Wed, 26 Aug 2026 20:13:30 +0000
Subject: [PATCH] fix(desktop): bound HTML comment scanning (#11406)

Signed-off-by: Jasper Hugo <jasper@spiral.xyz>
---
 ui/desktop/src/utils/htmlSecurity.test.ts | 10 ++++++++++
 ui/desktop/src/utils/htmlSecurity.ts      |  5 +++--
 2 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/ui/desktop/src/utils/htmlSecurity.test.ts b/ui/desktop/src/utils/htmlSecurity.test.ts
index a13eb74a0..b7702d1f9 100644
--- a/ui/desktop/src/utils/htmlSecurity.test.ts
+++ b/ui/desktop/src/utils/htmlSecurity.test.ts
@@ -1,4 +1,5 @@
 import { describe, it, expect } from 'vitest';
+import { performance } from 'node:perf_hooks';
 import { containsHTML, wrapHTMLInCodeBlock } from '../utils/htmlSecurity';
 
 describe('HTML Security Detection', () => {
@@ -93,6 +94,15 @@ describe('HTML Security Detection', () => {
         expect(containsHTML('<>')).toBe(false);
         expect(containsHTML('< div >')).toBe(false);
       });
+
+      it('rejects unterminated comment prefixes without blocking the renderer', () => {
+        const maliciousContent = '<!--'.repeat(64_000);
+        const startedAt = performance.now();
+
+        expect(containsHTML(maliciousContent)).toBe(false);
+
+        expect(performance.now() - startedAt).toBeLessThan(750);
+      }, 10_000);
     });
   });
 
diff --git a/ui/desktop/src/utils/htmlSecurity.ts b/ui/desktop/src/utils/htmlSecurity.ts
index c3a031a0f..951813096 100644
--- a/ui/desktop/src/utils/htmlSecurity.ts
+++ b/ui/desktop/src/utils/htmlSecurity.ts
@@ -15,8 +15,9 @@ export function containsHTML(str: string): boolean {
   const withoutCodeBlocks = str.replace(/```[\s\S]*?```/g, '').replace(/`[^`]*`/g, '');
 
   // Check for HTML comments first
-  const commentRegex = /<!--[\s\S]*?-->/;
-  const hasComments = commentRegex.test(withoutCodeBlocks);
+  const commentStart = withoutCodeBlocks.indexOf('<!--');
+  const hasComments =
+    commentStart !== -1 && withoutCodeBlocks.indexOf('-->', commentStart + 4) !== -1;
 
   // Only detect potentially dangerous HTML tags that could execute or affect layout
   const dangerousHTMLRegex =