From 26aa16f4b1e0d48b7b1c7688bcfef2a1c70d6d55 Mon Sep 17 00:00:00 2001
From: Nick Nicholas <opoudjis@gmail.com>
Date: Fri, 23 Aug 2024 23:05:15 +1000
Subject: [PATCH] security alerts

---
 lib/iev.rb           | 2 +-
 lib/iev/utilities.rb | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/lib/iev.rb b/lib/iev.rb
index de44c9e..bfcff71 100644
--- a/lib/iev.rb
+++ b/lib/iev.rb
@@ -43,7 +43,7 @@ def self.get(code, lang)
     a = doc&.at(xpath)&.children&.to_xml
     a&.sub(%r{<br/>.*$}, "")
       &.sub(%r{, &lt;.*$}, "")
-      &.gsub(%r{<[^>]*>}, "")&.strip
+      &.gsub(%r{<[^<>]*>}, "")&.strip
   end
 end
 
diff --git a/lib/iev/utilities.rb b/lib/iev/utilities.rb
index 3be3733..bd6645a 100644
--- a/lib/iev/utilities.rb
+++ b/lib/iev/utilities.rb
@@ -27,7 +27,7 @@ def parse_anchor_tag(text, term_domain)
           /<a href="?(IEV)?\s*(\d\d\d-\d\d-\d\d\d?)"?>(.*?)$/,
           '{{\3, IEV:\2}}',
         ).gsub(
-          /<a href="?(.*?)"?>(.*?)<\/a>/,
+          /<a href="?([^<>]*?)"?>(.*?)<\/a>/,
           '\1[\2]',
         ).gsub(
           Regexp.new([SIMG_PATH_REGEX, "\\s*", FIGURE_TWO_REGEX].join),
@@ -36,7 +36,7 @@ def parse_anchor_tag(text, term_domain)
           Regexp.new([SIMG_PATH_REGEX, "\\s*", FIGURE_ONE_REGEX].join),
           "#{IMAGE_PATH_PREFIX}/#{term_domain}/\\1[Figure \\2 - \\3]",
         ).gsub(
-          /<img\s+(.+?)\s*>/,
+          /<img\s+([^<>]+?)\s*>/,
           "#{IMAGE_PATH_PREFIX}/#{term_domain}/\\1[]",
         ).gsub(
           /<br>/,