From c0e85fbc82a670d67caf3e2e7f3a1d0aae784bf7 Mon Sep 17 00:00:00 2001
From: Thorsten Rinne <thorsten@phpmyfaq.de>
Date: Fri, 27 Feb 2026 10:55:34 +0100
Subject: [PATCH 1/2] Potential fix for code scanning alert no. 42: DOM text
 reinterpreted as HTML

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
---
 .../assets/src/utils/flesch-reading-ease.ts   | 25 +++++++++++++++++--
 1 file changed, 23 insertions(+), 2 deletions(-)

diff --git a/phpmyfaq/admin/assets/src/utils/flesch-reading-ease.ts b/phpmyfaq/admin/assets/src/utils/flesch-reading-ease.ts
index ff6813712b..8845a756bc 100644
--- a/phpmyfaq/admin/assets/src/utils/flesch-reading-ease.ts
+++ b/phpmyfaq/admin/assets/src/utils/flesch-reading-ease.ts
@@ -42,10 +42,31 @@ export type SupportedLanguage =
 
 /**
  * Strips HTML tags from content to get plain text
+ *
+ * This implementation avoids parsing the input as HTML to prevent
+ * reinterpreting arbitrary text as markup. It removes tag-like
+ * structures and decodes a small set of common HTML entities.
  */
 export const stripHtml = (html: string): string => {
-  const doc = new DOMParser().parseFromString(html, 'text/html');
-  return doc.body.textContent || '';
+  if (!html) {
+    return '';
+  }
+
+  // Remove HTML tags
+  let text = html.replace(/<[^>]*>/g, ' ');
+
+  // Decode a few common HTML entities needed for readability
+  text = text.replace(/&nbsp;/gi, ' ');
+  text = text.replace(/&amp;/gi, '&');
+  text = text.replace(/&lt;/gi, '<');
+  text = text.replace(/&gt;/gi, '>');
+  text = text.replace(/&quot;/gi, '"');
+  text = text.replace(/&#39;/g, "'");
+
+  // Normalize whitespace
+  text = text.replace(/\s+/g, ' ').trim();
+
+  return text;
 };
 
 /**

From c1015586b43614e93f665ac9ae0fd605a6239cbf Mon Sep 17 00:00:00 2001
From: Thorsten Rinne <thorsten@phpmyfaq.de>
Date: Fri, 27 Feb 2026 11:00:48 +0100
Subject: [PATCH 2/2] Potential fix for code scanning alert no. 43: Double
 escaping or unescaping

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
---
 phpmyfaq/admin/assets/src/utils/flesch-reading-ease.ts | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/phpmyfaq/admin/assets/src/utils/flesch-reading-ease.ts b/phpmyfaq/admin/assets/src/utils/flesch-reading-ease.ts
index 8845a756bc..59752a8181 100644
--- a/phpmyfaq/admin/assets/src/utils/flesch-reading-ease.ts
+++ b/phpmyfaq/admin/assets/src/utils/flesch-reading-ease.ts
@@ -57,11 +57,12 @@ export const stripHtml = (html: string): string => {
 
   // Decode a few common HTML entities needed for readability
   text = text.replace(/&nbsp;/gi, ' ');
-  text = text.replace(/&amp;/gi, '&');
   text = text.replace(/&lt;/gi, '<');
   text = text.replace(/&gt;/gi, '>');
   text = text.replace(/&quot;/gi, '"');
   text = text.replace(/&#39;/g, "'");
+  // Decode ampersand last to avoid double-unescaping sequences like "&amp;lt;"
+  text = text.replace(/&amp;/gi, '&');
 
   // Normalize whitespace
   text = text.replace(/\s+/g, ' ').trim();