mirror of
https://github.com/streamyfin/streamyfin.git
synced 2026-06-05 13:38:27 +01:00
Replace the regex-based comment stripper (flagged by CodeQL js/incomplete-multi-character-sanitization, alert #330) with a single linear indexOf scan. Behaviour is identical on complete, unterminated and nested comments, but there is no regex backtracking and no loop-until-stable, so the CodeQL alert clears without reintroducing the CPU-DoS risk.