From ca271dae5e4cd4f06797e23a939f51206fe4608f Mon Sep 17 00:00:00 2001
From: Fox6935 <tysonhofer@hotmail.com>
Date: Fri, 10 Jul 2026 22:28:27 -0500
Subject: [PATCH] Added HTML tag validation

Updated PawchiveParser to escape unknown HTML tags and added a check for known HTML tags.
---
 plugin/js/parsers/PawchiveParser.js | 25 +++++++++++++++++++++++--
 1 file changed, 23 insertions(+), 2 deletions(-)

diff --git a/plugin/js/parsers/PawchiveParser.js b/plugin/js/parsers/PawchiveParser.js
index 912fe6da..fc912f62 100644
--- a/plugin/js/parsers/PawchiveParser.js
+++ b/plugin/js/parsers/PawchiveParser.js
@@ -70,7 +70,7 @@ class PawchiveParser extends Parser {
         header.textContent = post.title;
         newDoc.content.appendChild(header);
 
-        let content = util.sanitize(post.content);
+        let content = util.sanitize(this.escapeUnknownTags(post.content));
         util.moveChildElements(content.body, newDoc.content);
 
         let attachments = post.attachments;
@@ -98,6 +98,27 @@ class PawchiveParser extends Parser {
         return newDoc.dom;
     }
 
+    escapeUnknownTags(html) {
+        return html.replace(/<([^<>]+)>/g, (match, inner) => {
+            let candidate = inner.trim();
+            if (candidate.startsWith("!--") ||
+                /^!doctype\b/i.test(candidate) ||
+                candidate.startsWith("?")) {
+                return match;
+            }
+            let tag = candidate.match(/^\/?\s*([A-Za-z][\w:-]*)/);
+            if (tag !== null && this.isKnownHtmlTag(tag[1])) {
+                return match;
+            }
+            return `&lt;${inner}&gt;`;
+        });
+    }
+
+    isKnownHtmlTag(tagName) {
+        let element = document.createElement(tagName);
+        return element.constructor.name !== "HTMLUnknownElement";
+    }
+
     buildImageUrl(path) {
         return new URL(
             "/thumbnail/data" + this.normalizePath(path),
@@ -160,4 +181,4 @@ class PawchiveParser extends Parser {
     extractTitleImpl(dom) {
         return dom.querySelector("h1");
     }
-}
\ No newline at end of file
+}