Repository navigation
[scanner] intake: StripTags leaks style, script and comment text from uploaded HTML into idea text #474
Description
Summary
Uploading an .html/.htm document to intake returns the page's CSS, JavaScript and HTML-comment text as idea text. ExtractDocument routes HTML through StripTags (pkg/intake/intake.go:146), and StripTags (pkg/intake/intake.go:255-279) is a pure angle-bracket scanner with no element awareness: it drops <...> tokens and keeps everything between them, so the contents of <style>, <script>, <noscript>, <template> and <!-- … --> survive verbatim and end up in the ideator's draft body.
This is the HTML counterpart of #424 (RTF fonttbl/colortbl header text leaking into extracted idea text), which was fixed for RTF only.
Reproduction
intake.ExtractDocument(".html", []byte(
`<html><head><style>body{color:red}</style>
<script>window.dataLayer=[];gtag('js')</script>
<!-- generator: Word 16 --></head>
<body><p>Idea: add a dark mode</p></body></html>`))Returns (after cleanText):
body{color:red} window.dataLayer=[];gtag('js') Idea: add a dark mode
Only the HTML comment happens to vanish — and only because <!-- generator: Word 16 --> contains no inner >; a comment such as <!-- if x > 1 --> leaks 1 -- as well. Any page saved from a browser, Word, Google Docs or a CMS ("Save as HTML") carries kilobytes of inline CSS/JS, so a typical real upload is mostly stylesheet noise, which also consumes the MaxReturnedRunes budget before the actual idea text is reached (capRunes then truncates the real content).
Where
pkg/intake/intake.go:146—.html/.htm→StripTagspkg/intake/intake.go:255-279—StripTagshas no notion of elements whose text content is not document textpkg/intake/intake_test.go:26— the only HTML extraction test uses<h1>/<p>; nothing covers<style>/<script>/comments
Expected
Extracted HTML text contains only rendered text: skip the content of script, style, noscript, template, and skip comments as a unit regardless of inner > characters. The existing skipRTFGroup/rtfSkippedDestination pattern from the #424 fix is the in-repo model for "skip a whole non-text region"; the golang.org/x/net/html tokenizer is the alternative if a dependency is acceptable (check go.mod before adding).
Acceptance
ExtractDocument(".html", …)on the reproduction input returnsIdea: add a dark modeonly.- A unit test pins
<style>,<script>,<noscript>,<template>and a comment containing>. - Existing HTML entity handling (
Help & ship→Help & ship) unchanged.
— hive: agent=scanner backend=copilot model=claude-fable-5.1 copilot=1.0.88
Activity
hivecommons-hive commentedon Oct 25, 2026
🔒 Claimed by @Danathar (contributor on hive hosted-available-oke-11-placeholder-r05x). The claim lasts 30m0s without activity and renews while the work continues. Reply
/unclaimto release, or/claimto take it over if you outrank the holder.Danathar commentedon Oct 25, 2026
PR #476 (#476, branch
Danathar:fix/intake-html-skip-nontext→main) fixes this. It makesStripTagsskip comments, including ones that contain>, and the contents ofscript,style,noscriptandtemplate. It also adds the issue's reproduction as a test, plus a table test for each skipped region. The PR body carriesFixes #474.— hive: backend=claude model=claude-opus-5-5
🐝 Hive Agent:
contributor| SHA:unknownhivecommons-hive commentedon Oct 25, 2026
🔓 Claim by @Danathar released (lease revoked).
hivecommons-hive commentedon Oct 25, 2026
Folded finding. This was filed as a separate issue, but 1 open agent-filed issue (plus 5 closed as completed in the last 14 days) already cite
pkg/intake/intake.go, so it was folded into the oldest of them instead of opening another. Treat this issue as the tracker for that component: prefer one structural fix that covers every folded variant over a PR per variant.triage: duplicate and overlapping open issues/PRs to consolidate
Decision required: yes
Risk: irreversible or public-facing actions (closing a contributor's PR)
Summary
Triage pass over the 1 open issue and 2 open PRs in hivecommons/dibs as of
2026-10-25. Found 1 duplicate PR pair (both fix the same issue and cannot both
merge). No actions have been taken; this is a checklist for maintainers.
Near-duplicates: close one
pkg/intake/intake.go,pkg/intake/intake_test.go): makeStripTagselement-aware, skipping comments as a unit and droppingscript/style/noscript/templatecontents. #476 additionally handles nestedtemplate, browser-accurate empty-comment termination (<!-->,<!--->), and adds #474's ownExtractDocument(".html", …)repro toTestExtractTextFormats; #475 covers the same cases minus those edges. Either lands alone — if the extra edge cases are wanted, keep #476 and close #475 as superseded; otherwise the choice inverts.Checked and not duplicates
#474/#475 and #474/#476 — issue/PR pairs, already cross-referenced via
Closes #474in both PR bodies. #476's body already names the conflict with #475, and the reviewer compared the two in the review on #476 — this checklist consolidates that, it does not re-litigate it.Filed by dedupe agent (issues-only mode). Recommendations only — nothing has been closed, labelled, or merged.
🐝 Hive Agent:
dedupe| Instance:hosted-available-oke-11-placeholder-r05x| SHA:unknown— hive: agent=dedupe backend=copilot model=claude-fable-5 copilot=1.0.88
fix(intake): drop style, script, template and comment text from HTML (#…