max / goingson

email reader: detect any HTML tag for reader-mode strip, not a tag denylist Replace the hand-maintained <html>/<div>/<p>/<br> includes-check (which missed <img>/<a>) with a general tag regex. escapeHtml remains the unconditional XSS defense; this only improves which HTML emails get reader-mode cleanup (ultra-fuzz Run #28). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: Max Johnson <me@maxj.phd> · 2026-06-19 19:54 UTC

Commit: 15b1025e0f1e8b5b43dfa5712912d96c0ec5a458

Parent: dcf3f5f

1 file changed, +5 insertions, -3 deletions

M src-tauri/frontend/js/utils.js +5 -3

			@@ -317,10 +317,12 @@ function validateForm(form) {
317	317		function formatEmailBody(body) {
318	318		if (!body) return '';
319	319
320		-	// Check if body contains HTML that needs stripping
	320	+	// Strip HTML for reader mode if the body contains any tag. (Detect any
	321	+	// `<tag …>` rather than a hand-maintained denylist that missed e.g. <img>/<a>;
	322	+	// escapeHtml below is the actual XSS defense and runs unconditionally either
	323	+	// way, so this only affects readability — ultra-fuzz Run #28.)
321	324		let text = body;
322		-	if (body.includes('<html') \|\| body.includes('<body') \|\| body.includes('<div') \|\|
323		-	body.includes('<table') \|\| body.includes('<p>') \|\| body.includes('<br')) {
	325	+	if (/<[a-z][a-z0-9]\b[^>]>/i.test(body)) {
324	326		text = stripHtmlForReaderMode(body);
325	327		}
326	328