Skip to content

Strip <script> from migrated CMS memo HTML #2

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
posthog wants to merge 1 commit into
base: main
Choose a base branch
from
Draft

Strip <script> from migrated CMS memo HTML #2

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 13 additions & 1 deletion src/app/(frontend)/memos/[slug]/page.tsx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,18 @@ function getMediaUrl(media: unknown): string {
return m.url || "/images/Logo-Box.png";
}

/**
* Remove every <script> element from CMS HTML.
* Migrated Webflow bodies are server-rendered verbatim, so any inline script
* runs when the browser parses the page. Editors must not be able to run
* unchecked JavaScript through memo content.
*/
function stripScripts(html: string): string {
return html
.replace(/<script\b[^>]*>[\s\S]*?<\/script\s*>/gi, "")
.replace(/<script\b[^>]*\/?>/gi, "");
}

/**
* Extract raw HTML from a Lexical richtext field that was migrated from Webflow.
* The migration stored the entire HTML string as a single Lexical text node.
Expand All @@ -36,7 +48,7 @@ function extractHtmlFromLexical(data: unknown): string | null {
const textNode = textChildren[0];
if (textNode.type !== "text") return null;
const text = textNode.text as string;
if (/<[a-z][\s\S]*>/i.test(text)) return text;
if (/<[a-z][\s\S]*>/i.test(text)) return stripScripts(text);
return null;
}

Expand Down