From a4ca026e8207f7faf2d3650187979f2c3d181f93 Mon Sep 17 00:00:00 2001
From: Claude Fable 5 <noreply@anthropic.com>
Date: Sat, 22 Aug 2026 13:16:11 +0200
Subject: [PATCH] Strip style/script/xml blocks and table structure before
 sanitizing pasted HTML

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 src/Service/SurveyHtmlSanitizer.php | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/src/Service/SurveyHtmlSanitizer.php b/src/Service/SurveyHtmlSanitizer.php
index d875cd4..ad2f593 100644
--- a/src/Service/SurveyHtmlSanitizer.php
+++ b/src/Service/SurveyHtmlSanitizer.php
@@ -34,10 +34,17 @@ final class SurveyHtmlSanitizer
             $html = $this->convertPlainTextToHtml($html);
         }
 
+        // Elemente samt Inhalt komplett entfernen, bevor der Parser sie sieht –
+        // Word/Outlook liefern <style>- und <xml>-Blöcke mit, deren Text sonst
+        // (je nach Parser-Kontext) als sichtbarer Inhalt übrig bleiben kann.
+        $html = (string) preg_replace('#<(script|style|head|title|iframe|object|template|noscript|xml|svg|math)\b[^>]*>.*?</\1\s*>#is', ' ', $html);
+        $html = (string) preg_replace('#<!--.*?-->#s', ' ', $html);
+
         // Fremde Blockelemente (z. B. aus dem Backend-TinyMCE oder aus Word-Kopien)
         // in Absätze überführen, damit der Text nicht zusammenläuft.
-        $html = (string) preg_replace('#<(div|h[1-6]|blockquote|section|article|header|footer|pre|address)\b[^>]*>#i', '<p>', $html);
-        $html = (string) preg_replace('#</(div|h[1-6]|blockquote|section|article|header|footer|pre|address)>#i', '</p>', $html);
+        $html = (string) preg_replace('#<(div|h[1-6]|blockquote|section|article|header|footer|pre|address|tr|dt|dd)\b[^>]*>#i', '<p>', $html);
+        $html = (string) preg_replace('#</(div|h[1-6]|blockquote|section|article|header|footer|pre|address|tr|dt|dd)>#i', '</p>', $html);
+        $html = (string) preg_replace('#</t[dh]>\s*<t[dh]\b[^>]*>#i', ' – ', $html);
 
         $clean = $this->getSanitizer()->sanitize($html);