From b976669ad3b21ad37c8aa2af3ef5709e2a58fe35 Mon Sep 17 00:00:00 2001
From: Yang Jun <harttleharttle@gmail.com>
Date: Sun, 3 May 2026 12:31:43 +0800
Subject: [PATCH] fix(strip_html): match tags that span newlines inside angle
 brackets

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 src/filters/html.ts                   | 2 +-
 test/integration/filters/html.spec.ts | 5 +++++
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/src/filters/html.ts b/src/filters/html.ts
index 3121857e3..0dd5f77d3 100644
--- a/src/filters/html.ts
+++ b/src/filters/html.ts
@@ -45,5 +45,5 @@ export function newline_to_br (this: FilterImpl, v: string) {
 export function strip_html (this: FilterImpl, v: string) {
   const str = stringify(v)
   this.context.memoryLimit.use(str.length)
-  return str.replace(/<script[\s\S]*?<\/script>|<style[\s\S]*?<\/style>|<.*?>|<!--[\s\S]*?-->/g, '')
+  return str.replace(/<script[\s\S]*?<\/script>|<style[\s\S]*?<\/style>|<[\s\S]*?>|<!--[\s\S]*?-->/g, '')
 }
diff --git a/test/integration/filters/html.spec.ts b/test/integration/filters/html.spec.ts
index fce809d3a..c4551dad4 100644
--- a/test/integration/filters/html.spec.ts
+++ b/test/integration/filters/html.spec.ts
@@ -77,5 +77,10 @@ describe('filters/html', function () {
     it('should strip until empty', function () {
       return test('{{"<br/><br />< p ></p></ p >" | strip_html }}', '')
     })
+    it('should strip generic tags spanning ASCII newlines inside the tag', function () {
+      expect(liquid.parseAndRenderSync('{{"<img\nsrc=x\nonerror=alert(1)>" | strip_html}}')).toBe('')
+      expect(liquid.parseAndRenderSync('{{"<img\rsrc=x\ronerror=alert(1)>" | strip_html}}')).toBe('')
+      expect(liquid.parseAndRenderSync('{{"<svg\nonload=alert(1)>" | strip_html}}')).toBe('')
+    })
   })
 })