fix: address pr-bug-scan validated finding from #6471

stripTags now removes real markup (closing/self-closing/attributed/custom tags) outside the allow-list; only bare identifier-glued generics like Array<string> are kept. Blocks svg/center/custom leak a

mobile/src/components/MobileMarkdown.test.ts

@@ -91,4 +91,16 @@ describe('parseMobileMarkdown', () => {
       `${literalPlaceholder} and \`Array<string>\``
     )
   })
+
+  it('strips HTML tags outside the allow-list instead of leaking raw markup', () => {
+    const svg = normalizeMobileMarkdownPreviewHtml(
+      '<p>Logo <svg viewBox="0 0 1 1"><path d="M0 0"/></svg> done</p>'
+    )
+    expect(svg).not.toContain('<svg')
+    expect(svg).not.toContain('<path')
+    expect(svg).toContain('Logo')
+    expect(svg).toContain('done')
+    expect(normalizeMobileMarkdownPreviewHtml('<center>Title</center>')).toBe('Title')
+    expect(normalizeMobileMarkdownPreviewHtml('<my-widget>Hi</my-widget>')).toBe('Hi')
+  })
 })

mobile/src/components/mobile-markdown-preview-html.ts

@@ -54,8 +54,25 @@ function stripTags(value: string): string {
   const stripped = decodeHtmlEntities(
     protectedText
       .replace(/<!--[\s\S]*?-->/g, '')
-      .replace(/<\/?([A-Za-z][A-Za-z0-9:-]*)(?:\s[^<>]*)?\/?>/g, (tag, name: string) =>
-        strippableHtmlTagNames.has(name.toLowerCase()) ? '' : tag
+      .replace(
+        /(\w)?(<\/?)([A-Za-z][A-Za-z0-9:-]*)((?:\s[^<>]*)?)(\/?)>/g,
+        (match, prevChar: string | undefined, open: string, name: string, attrs: string, selfClose: string) => {
+          // Why: distinguish real HTML/markup tags from generic-type prose like
+          // `Array<string>`. Closing/self-closing/attributed tags and
+          // custom/namespaced names (hyphen or colon) are never generics, so
+          // strip them regardless of the allow-list. A bare `<word>` is only a
+          // generic when glued to a preceding identifier char.
+          const looksLikeGeneric =
+            Boolean(prevChar) &&
+            open !== '</' &&
+            selfClose !== '/' &&
+            attrs.trim().length === 0 &&
+            !/[-:]/.test(name)
+          if (looksLikeGeneric && !strippableHtmlTagNames.has(name.toLowerCase())) {
+            return match
+          }
+          return prevChar ?? ''
+        }
       ),
     true
   )