fix(socratiq): loop strip in vite dev injector

Single-pass replace can leave overlapping matches re-formed (e.g.
<scrip<script ...></script>t...></script>). Iterate until stable so
the dev-server injector never serves a half-stripped script tag.

Input is the package's own on-disk HTML, so this is defense-in-depth
rather than a live exploit, but it clears the CodeQL alert.

Closes CodeQL #108.

Author: profvjreddi

socratiq/vite.config.dev.mjs

@@ -175,9 +175,14 @@ export default defineConfig({
               // Remove ANY script tags pointing to src_shadow/js/index.js or production dist
               // This handles various relative paths and optional attributes like type="module"
               const distScriptRe = /<script\b[^>]*src=["'](?:(?:\.\.\/)*src_shadow\/js\/|\.\/scripts\/ai_menu\/dist\/)[^"']+\.js["'][^>]*><\/script>/gi;
-              const before = html;
-              html = html.replace(distScriptRe, '');
-              const removedCount = (before.match(distScriptRe) || []).length;
+              const removedCount = (html.match(distScriptRe) || []).length;
+              // Loop until stable: a single replace can leave overlapping matches re-formed
+              // (e.g. <scrip<script ...></script>t...></script>). Iterating closes that gap.
+              let prev;
+              do {
+                prev = html;
+                html = html.replace(distScriptRe, '');
+              } while (html !== prev);
               if (removedCount > 0) console.log(`[vite-dev] injector removed ${removedCount} script tag(s)`);
 
               // Append dev entry which Vite will transform & HMR