diff --git a/phpmyfaq/admin/assets/src/utils/flesch-reading-ease.ts b/phpmyfaq/admin/assets/src/utils/flesch-reading-ease.ts index ff6813712b..59752a8181 100644 --- a/phpmyfaq/admin/assets/src/utils/flesch-reading-ease.ts +++ b/phpmyfaq/admin/assets/src/utils/flesch-reading-ease.ts @@ -42,10 +42,32 @@ export type SupportedLanguage = /** * Strips HTML tags from content to get plain text + * + * This implementation avoids parsing the input as HTML to prevent + * reinterpreting arbitrary text as markup. It removes tag-like + * structures and decodes a small set of common HTML entities. */ export const stripHtml = (html: string): string => { - const doc = new DOMParser().parseFromString(html, 'text/html'); - return doc.body.textContent || ''; + if (!html) { + return ''; + } + + // Remove HTML tags + let text = html.replace(/<[^>]*>/g, ' '); + + // Decode a few common HTML entities needed for readability + text = text.replace(/ /gi, ' '); + text = text.replace(/</gi, '<'); + text = text.replace(/>/gi, '>'); + text = text.replace(/"/gi, '"'); + text = text.replace(/'/g, "'"); + // Decode ampersand last to avoid double-unescaping sequences like "&lt;" + text = text.replace(/&/gi, '&'); + + // Normalize whitespace + text = text.replace(/\s+/g, ' ').trim(); + + return text; }; /**