Lazy regexes on untrusted input

// before: rescans the remaining input for every unclosed "<style"
text = html.replace(/<style[\s\S]*?<\/style>/gi, " ");
// after: one pass, bounded lookahead
for (let i = 0; i < html.length; ) {
  const lt = html.indexOf("<", i);
  if (lt === -1) { out += html.slice(i); break; }
  out += html.slice(i, lt);
  i = skipTag(html, lt, /* max tag length */ 2048);  // jumps past a real </style>, never backtracks
}