From 23c26569a45d98a72c1c8032ff357ab4beed545f Mon Sep 17 00:00:00 2001
From: Hamed Niroomand <hamed@niroomand.dev>
Date: Sat, 15 Aug 2026 15:55:24 +0400
Subject: [PATCH] fix(ui): strip truncated html from package descriptions

---
 app/composables/useMarkdown.ts             |  7 +++++++
 shared/utils/html.ts                       |  3 ++-
 test/nuxt/composables/use-markdown.spec.ts | 14 +++++++++++++-
 test/unit/shared/utils/html.spec.ts        | 16 ++++++++++++++++
 4 files changed, 38 insertions(+), 2 deletions(-)

diff --git a/app/composables/useMarkdown.ts b/app/composables/useMarkdown.ts
index bcf8678096..6d948bef25 100644
--- a/app/composables/useMarkdown.ts
+++ b/app/composables/useMarkdown.ts
@@ -56,6 +56,12 @@ function stripAndEscapeHtml(text: string): string {
     (match, codeSpan: string | undefined) => codeSpan ?? '',
   )
 
+  // Strip unclosed HTML tags left by registry truncation (no closing '>')
+  stripped = stripped.replace(
+    /(`[^`]*`)|<\/?[a-z][^>]*$/gi,
+    (match, codeSpan: string | undefined) => codeSpan ?? '',
+  )
+
   // Strip HTML comments: <!-- ... --> (including unclosed comments from truncation)
   stripped = stripped.replace(
     /(`[^`]*`)|<!--[\s\S]*?(-->|$)/g,
@@ -69,6 +75,7 @@ function stripAndEscapeHtml(text: string): string {
     .replace(/>/g, '&gt;')
     .replace(/"/g, '&quot;')
     .replace(/'/g, '&#039;')
+    .trim()
 }
 
 // Parse simple inline markdown to HTML
diff --git a/shared/utils/html.ts b/shared/utils/html.ts
index 1f9de45c67..ad054a1002 100644
--- a/shared/utils/html.ts
+++ b/shared/utils/html.ts
@@ -25,7 +25,8 @@ export function stripHtmlTags(text: string): string {
     previous = result
     result = result.replace(tagPattern, '')
   } while (result !== previous)
-  return result
+  // Strip unclosed HTML tags left by registry truncation (no closing '>')
+  return result.replace(/<\/?[a-z][^>]*$/gi, '').trim()
 }
 /**
  * Generate a GitHub-style slug from heading text.
diff --git a/test/nuxt/composables/use-markdown.spec.ts b/test/nuxt/composables/use-markdown.spec.ts
index 2002a5ad30..fc226c9b5b 100644
--- a/test/nuxt/composables/use-markdown.spec.ts
+++ b/test/nuxt/composables/use-markdown.spec.ts
@@ -256,6 +256,18 @@ describe('useMarkdown', () => {
       const processed = useMarkdown({ text: '<b>bold</b> and **also bold**' })
       expect(processed.value).toBe('bold and <strong>also bold</strong>')
     })
+
+    it('strips unclosed HTML tags (truncated)', () => {
+      const processed = useMarkdown({
+        text: '<p>   <a href="https://www.npmjs.com/package/vue-tsc"><img src="https://img.shields.io/npm/v/vue-tsc.svg?labelColor=18181B&color=1584FC" alt="NPM version"></a>   <a href="https://github.com/vuejs/language-tools/blob/master/LICENSE"><img src="https://img.s',
+      })
+      expect(processed.value).toBe('')
+    })
+
+    it('strips a trailing unclosed tag but keeps preceding text', () => {
+      const processed = useMarkdown({ text: 'A library <img src="https://img.s' })
+      expect(processed.value).toBe('A library')
+    })
   })
 
   describe('HTML comment stripping', () => {
@@ -286,7 +298,7 @@ describe('useMarkdown', () => {
 
     it('strips unclosed HTML comments (truncated)', () => {
       const processed = useMarkdown({ text: 'A library <!-- automd:badges color=yel' })
-      expect(processed.value).toBe('A library ')
+      expect(processed.value).toBe('A library')
     })
   })
 
diff --git a/test/unit/shared/utils/html.spec.ts b/test/unit/shared/utils/html.spec.ts
index e6744a45d3..18d05c91c0 100644
--- a/test/unit/shared/utils/html.spec.ts
+++ b/test/unit/shared/utils/html.spec.ts
@@ -48,4 +48,20 @@ describe('stripHtmlTags', () => {
     const raw = '&lt;a href=&quot;url&quot;&gt;link&lt;/a&gt; and text'
     expect(stripHtmlTags(decodeHtmlEntities(raw))).toBe('link and text')
   })
+
+  it('removes unclosed HTML tags at the end of truncated text', () => {
+    expect(stripHtmlTags('A library <img src="https://img.s')).toBe('A library')
+  })
+
+  it('returns empty string when truncated text is only HTML tags', () => {
+    expect(
+      stripHtmlTags(
+        '<p>   <a href="https://www.npmjs.com/package/vue-tsc"><img src="https://img.shields.io/npm/v/vue-tsc.svg"></a>   <img src="https://img.s',
+      ),
+    ).toBe('')
+  })
+
+  it('leaves comparison text that is not a tag', () => {
+    expect(stripHtmlTags('a < b')).toBe('a < b')
+  })
 })