From 5c3522f33928aae66f0fe85c36e1d9015c768fe2 Mon Sep 17 00:00:00 2001
From: Yang Jun <harttleharttle@gmail.com>
Date: Mon, 22 Jun 2026 02:28:07 +0800
Subject: [PATCH] fix(strip_html): infinite loop for strip_html

---
 .gitignore                            | 1 +
 docs/source/filters/strip_html.md     | 8 ++++++++
 src/filters/html.ts                   | 2 +-
 test/integration/filters/html.spec.ts | 4 ++++
 4 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/.gitignore b/.gitignore
index 24be3ed8d..9fe5dbbf8 100644
--- a/.gitignore
+++ b/.gitignore
@@ -11,6 +11,7 @@ coverage/
 node_modules/
 
 # tmp
+.local/
 docs/themes/navy/source/js/liquid.browser.min.js
 docs/themes/navy/layout/partial/all-contributors.swig
 docs/themes/navy/layout/partial/financial-contributors.swig
diff --git a/docs/source/filters/strip_html.md b/docs/source/filters/strip_html.md
index 86248716b..ccb4f581c 100644
--- a/docs/source/filters/strip_html.md
+++ b/docs/source/filters/strip_html.md
@@ -6,6 +6,10 @@ title: strip_html
 
 Removes any HTML tags from a string.
 
+{% note warn Not safe for HTML output %}
+This filter removes tags by string scanning; it does not parse HTML5 the way a browser does, and it is not a sanitizer. The result may still be unsafe when inserted into HTML. Use [escape][escape], [escape_once][escape_once], or [`outputEscape: "escape"`][outputEscape] for untrusted output.
+{% endnote %}
+
 Input
 ```liquid
 {{ "Have <em>you</em> read <strong>Ulysses</strong>?" | strip_html }}
@@ -15,3 +19,7 @@ Output
 ```text
 Have you read Ulysses?
 ```
+
+[escape]: ./escape.html
+[escape_once]: ./escape.html
+[outputEscape]: ../tutorials/options.html#outputEscape
diff --git a/src/filters/html.ts b/src/filters/html.ts
index 807c42373..b52f1b3da 100644
--- a/src/filters/html.ts
+++ b/src/filters/html.ts
@@ -60,7 +60,7 @@ export function strip_html (this: FilterImpl, v: string) {
       if (e >= 0) { i = e + closer.length; break }
       blocks.delete(opener)
     }
-    if (i === lt) return out + str.slice(lt)
+    if (i <= lt) return out + str.slice(lt)
   }
   return out
 }
diff --git a/test/integration/filters/html.spec.ts b/test/integration/filters/html.spec.ts
index e858420e0..fdf75e4c6 100644
--- a/test/integration/filters/html.spec.ts
+++ b/test/integration/filters/html.spec.ts
@@ -85,5 +85,9 @@ describe('filters/html', function () {
       expect(liquid.parseAndRenderSync('{{"<img\rsrc=x\ronerror=alert(1)>" | strip_html}}')).toBe('')
       expect(liquid.parseAndRenderSync('{{"<svg\nonload=alert(1)>" | strip_html}}')).toBe('')
     })
+    it('should not loop on unclosed openers (GHSA-m7fp-h3p4-hr49)', function () {
+      expect(liquid.parseAndRenderSync('{{ "a<" | strip_html }}')).toBe('a<')
+      expect(liquid.parseAndRenderSync('{{ "hello<world<again" | strip_html }}')).toBe('hello<world<again')
+    })
   })
 })