HTML Input for PDF Generation

pom.xml

@@ -92,12 +92,21 @@
             <artifactId>utils-mail-dkim</artifactId>
             <version>2.0.1</version>
         </dependency>
+
+        <!-- Used to generate PDFs -->
         <dependency>
             <groupId>org.xhtmlrenderer</groupId>
             <artifactId>flying-saucer-pdf</artifactId>
             <version>9.8.0</version>
         </dependency>
 
+        <!-- Used to clean HTML before generating PDF -->
+        <dependency>
+            <groupId>org.jsoup</groupId>
+            <artifactId>jsoup</artifactId>
+            <version>1.17.2</version>
+        </dependency>
+
         <!-- POI is used to generate excel exports -->
         <dependency>
             <groupId>org.apache.poi</groupId>

src/main/java/sirius/web/templates/pdf/TagliatellePDFContentHandler.java

@@ -8,6 +8,9 @@
 
 package sirius.web.templates.pdf;
 
+import org.jsoup.Jsoup;
+import org.jsoup.nodes.Document;
+import org.jsoup.nodes.Entities;
 import org.xhtmlrenderer.pdf.ITextRenderer;
 import sirius.kernel.di.std.Part;
 import sirius.kernel.di.std.Register;
@@ -53,14 +56,38 @@ public boolean generate(Generator generator, OutputStream out) throws Exception
         ITextRenderer renderer = new ITextRenderer();
         renderer.getSharedContext()
                 .setReplacedElementFactory(new ImageReplacedElementFactory(renderer.getOutputDevice()));
-        renderer.setDocumentFromString(content);
+        renderer.setDocumentFromString(cleanHtml(content));
         renderer.layout();
         renderer.createPDF(out);
         out.flush();
 
         return true;
     }
 
+    /**
+     * Cleans the given HTML content for use as input to the PDF generator.
+     * <p>
+     * This is done by first generally removing all {@code <script>} elements from the entire document. Then, all
+     * {@code <style>} elements are deleted that are outside the {@code <header>} element. Finally, the DOM tree
+     * is encoded as XHTML fit for the strict SAX parser employed by {@link ITextRenderer}.
+     *
+     * @param html the HTML content to clean
+     * @return the given content with problematic elements removed and encoded as valid XHTML
+     */
+    private String cleanHtml(String html) {
+        Document document = Jsoup.parse(html);
+
+        // in theory, the following two lines should be possible with a single CSS selector; however, in practice, Jsoup
+        // does not select the style elements correctly when attempting that
+        document.select("script").remove();
+        document.select("body style").remove();
+
+        document.outputSettings().syntax(Document.OutputSettings.Syntax.xml);
+        document.outputSettings().escapeMode(Entities.EscapeMode.xhtml);
+        document.outputSettings().charset("UTF-8");
+        return document.html();
+    }
+
     @Override
     public int getPriority() {
         return DEFAULT_PRIORITY;