Strip <script> from migrated CMS memo HTML

[posthog]

Problem

• iOS Safari visitors to a memo hit two JS errors (Can't find variable: CONFIG, Can't find variable: currentInset) that are one broken layout script degrading the footer. The class defect is bigger than the symptom: a memo body can run any JavaScript an editor pastes.
• Migrated Webflow memo bodies are stored as raw HTML in Payload and server-rendered verbatim through dangerouslySetInnerHTML at memos/[slug]/page.tsx. Server-rendered <script> tags run on page parse, with no build-time checking.
• RichTextOrHtml is the single choke point for body, appendix, supporters, and twitterEmbed, so this path is the only source of the offending script.

Changes

• Add stripScripts and apply it at the HTML extraction boundary (extractHtmlFromLexical), so no CMS-supplied <script> reaches the rendered page.
• Removes paired script blocks, external src scripts, and orphan/self-closing script tags. Match is case-insensitive and spans newlines.

Impact and caveats

• Fixes the observed crash for the affected memo and every other memo, without needing live database access.
• Twitter embeds lose their widget enhancement (the widgets.js script is stripped); the <blockquote> fallback with a link to the tweet still renders. No crash.
• Non-script HTML (headings, paragraphs, blockquotes, links) is unchanged.

Note

Verified before shipping: this repo is the only dangerouslySetInnerHTML path. Separately, wrangler.jsonc sets PROJECT_DOMAIN to website.canadasbuilding.com — confirm this repo serves www.buildcanada.com before deploy; that config is out of scope for this fix.

Agent context

• No test framework is present and dependencies are not installed in this environment. The strip logic was verified directly against the interleaved layout script from the report, an external Twitter widget script, mixed-case tags, and orphan tags. The stored Payload document was not reachable, so the fix is applied at render time to cover it and all other memos.

---

Created with PostHog Desktop from this inbox report.