From d4033cdae7205662724e7e4a57b2f804b50c82f2 Mon Sep 17 00:00:00 2001
From: "posthog[bot]" <206114724+posthog[bot]@users.noreply.github.com>
Date: Fri, 28 Aug 2026 22:44:26 +0000
Subject: [PATCH] Strip <script> from migrated CMS memo HTML

Migrated Webflow memo bodies are stored as raw HTML and server-rendered
verbatim through dangerouslySetInnerHTML, so any inline <script> in the
content runs when the browser parses the page. Remove every script element
at the HTML extraction boundary so CMS content can no longer run unchecked
JavaScript.

Generated-By: PostHog Desktop
Task-Id: 3abd404c-aa20-468c-820f-f1e8c2851a63
---
 src/app/(frontend)/memos/[slug]/page.tsx | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/src/app/(frontend)/memos/[slug]/page.tsx b/src/app/(frontend)/memos/[slug]/page.tsx
index e86cae7..946f3b3 100644
--- a/src/app/(frontend)/memos/[slug]/page.tsx
+++ b/src/app/(frontend)/memos/[slug]/page.tsx
@@ -12,6 +12,18 @@ function getMediaUrl(media: unknown): string {
 	return m.url || "/images/Logo-Box.png";
 }
 
+/**
+ * Remove every <script> element from CMS HTML.
+ * Migrated Webflow bodies are server-rendered verbatim, so any inline script
+ * runs when the browser parses the page. Editors must not be able to run
+ * unchecked JavaScript through memo content.
+ */
+function stripScripts(html: string): string {
+	return html
+		.replace(/<script\b[^>]*>[\s\S]*?<\/script\s*>/gi, "")
+		.replace(/<script\b[^>]*\/?>/gi, "");
+}
+
 /**
  * Extract raw HTML from a Lexical richtext field that was migrated from Webflow.
  * The migration stored the entire HTML string as a single Lexical text node.
@@ -36,7 +48,7 @@ function extractHtmlFromLexical(data: unknown): string | null {
 	const textNode = textChildren[0];
 	if (textNode.type !== "text") return null;
 	const text = textNode.text as string;
-	if (/<[a-z][\s\S]*>/i.test(text)) return text;
+	if (/<[a-z][\s\S]*>/i.test(text)) return stripScripts(text);
 	return null;
 }