From ad1befcc7eec3c57c2b7eaae22beb489e5727c53 Mon Sep 17 00:00:00 2001
From: kisjelica <kisjelicarastko@gmail.com>
Date: Fri, 25 Sep 2026 11:53:28 +0200
Subject: [PATCH] fix: strip script/style elements when converting HTML to
 XHTML

XPath text extraction (e.g. normalize-space() over a content container)
returns a node's full string-value, which includes descendant text nodes
inside nested <script> and <style> elements. Sites that inject JSON-LD or
other markup via client-side JS directly into a content container (as
seen on maybelline.com.tr, where BreadcrumbList/HowTo/Article JSON-LD
ended up inside schema:articleBody) leak that markup into any graph-sync
mapping that extracts text from the container.

HtmlConverter already strips comment and processing-instruction nodes
before XPath mappings run; extend the same pass to remove <script> and
<style> elements so their text never reaches XPath-based extraction.
---
 docs/html_converter.md               |  1 +
 tests/utils/test_html_converter.py   | 31 ++++++++++++++++++++++++++++
 wordlift_sdk/utils/html_converter.py |  7 ++++++-
 3 files changed, 38 insertions(+), 1 deletion(-)
diff --git a/docs/html_converter.md b/docs/html_converter.md
index 04d45db..3b09fa5 100644
--- a/docs/html_converter.md
+++ b/docs/html_converter.md
@@ -11,6 +11,7 @@ The `HtmlConverter` utility class provides a mechanism to convert HTML strings i
 - **Namespace Safety**: Rewrites undeclared prefixed tags (e.g. `o:p` -> `p`) and removes undeclared prefixed attributes (e.g. `foo:bar`) to avoid XML parser `unbound prefix` failures.
 - **XPath Compatibility**: Strips default XHTML `xmlns` declarations so unprefixed XPath selectors (e.g. `.//div`, `.//h1`) work on converted output.
 - **Malformed Node Cleanup**: Removes comment and processing-instruction nodes that can serialize into XML-invalid token sequences.
+- **Script/Style Removal**: Removes `<script>` and `<style>` elements (and their text content, e.g. embedded JSON-LD) so downstream XPath mappings never extract non-visible markup as page text.
 - **Validation Guardrail**: Validates serialized XHTML with `xml.etree.ElementTree.fromstring()` and applies a stricter fallback sanitation pass before failing with line/column context.
 - **Encoding**: Produces UTF-8 encoded, recover-mode parsed XHTML.
 
diff --git a/tests/utils/test_html_converter.py b/tests/utils/test_html_converter.py
index 869d950..ec3bb58 100644
--- a/tests/utils/test_html_converter.py
+++ b/tests/utils/test_html_converter.py
@@ -118,6 +118,37 @@ def test_convert_removes_xml_invalid_comments(self, converter):
         assert "<p>ok</p>" in xhtml_output
         ET.fromstring(xhtml_output)
 
+    def test_convert_removes_script_and_style_tags(self, converter):
+        """Script/style elements (and their text) are removed so XPath text
+        extraction over a container never picks up embedded JSON-LD or CSS."""
+        if lxml_html is None:
+            pytest.skip("lxml not installed")
+
+        html_input = """
+<html><body>
+  <div class="article-body">
+    <p>Real content before.</p>
+    <script type="application/ld+json">{"@context": "https://schema.org", "@type": "BreadcrumbList"}</script>
+    <style>.foo { color: red; }</style>
+    <p>Real content after.</p>
+  </div>
+</body></html>
+"""
+        xhtml_output = converter.convert(html_input)
+
+        assert "<script" not in xhtml_output
+        assert "<style" not in xhtml_output
+        assert "@context" not in xhtml_output
+        assert "color: red" not in xhtml_output
+        assert "Real content before." in xhtml_output
+        assert "Real content after." in xhtml_output
+
+        root = ET.fromstring(xhtml_output)
+        container = root.find(".//div")
+        full_text = "".join(container.itertext())
+        assert "@context" not in full_text
+        assert "color: red" not in full_text
+
     def test_convert_removes_default_xmlns_for_xpath_compat(self, converter):
         """Default XHTML namespace is removed so unprefixed XPath matches work."""
         if lxml_html is None:
diff --git a/wordlift_sdk/utils/html_converter.py b/wordlift_sdk/utils/html_converter.py
index 4313e32..7905d33 100644
--- a/wordlift_sdk/utils/html_converter.py
+++ b/wordlift_sdk/utils/html_converter.py
@@ -144,7 +144,12 @@ def _sanitize_xhtml_tree(self, doc: Any) -> None:
     def _remove_problem_nodes(self, doc: Any) -> None:
         if not hasattr(doc, "xpath"):
             return
-        for query in ("//comment()", "//processing-instruction()"):
+        for query in (
+            "//comment()",
+            "//processing-instruction()",
+            "//script",
+            "//style",
+        ):
             for node in doc.xpath(query):
                 parent = node.getparent()
                 if parent is not None:
