Potential fix for code scanning alert no. 122: Incomplete multi-character sanitization

package.json

@@ -113,7 +113,8 @@
     "undici": "^5.28.5",
     "vaul": "^1.1.2",
     "vercel": "^44.7.3",
-    "zod": "^4.0.17"
+    "zod": "^4.0.17",
+    "sanitize-html": "^2.17.0"
   },
   "devDependencies": {
     "@eslint/js": "^9.33.0",

src/lib/search-service.ts

@@ -1,3 +1,4 @@
+import sanitizeHtml from 'sanitize-html';
 import * as Sentry from '@sentry/react';
 import { withTimeout } from './ai-utils';
 import { createTokenBucketRateLimiter } from './rate-limiter';
@@ -316,9 +317,16 @@ export class BraveSearchService {
   }
 
   private extractTextContent(html: string): string {
-    return html
-      .replace(/<script[^>]*>.*?<\/script>/gi, '')
-      .replace(/<style[^>]*>.*?<\/style>/gi, '')
+    // Use sanitize-html to remove <script> and <style> tags and their content
+    const sanitized = sanitizeHtml(html, {
+      allowedTags: false, // remove all tags, but we want to keep text content
+      disallowedTagsMode: 'discard',
+      exclusiveFilter: (frame) => {
+        // Remove the content of script and style tags
+        return frame.tag === 'script' || frame.tag === 'style';
+      }
+    });
+    return sanitized
       .replace(/<[^>]*>/g, ' ')
       .replace(/\s+/g, ' ')
       .trim();