fix(fetchers): avoid utf-8 panic in hn html stripping (#115)

Iterate `strip_html_tags` input with `char_indices()` and compute the `<p>`-lookahead slice from `idx + c.len_utf8()` instead of `html.len() - (html.len() - result.len())`, which dropped UTF-8 byte alignment when non-ASCII characters had been skipped from `result`. Prevents a panic on untrusted HN item/comment text.

Author: chaliy

crates/fetchkit/src/fetchers/hackernews.rs

@@ -320,15 +320,12 @@ fn strip_html_tags(html: &str) -> String {
     let mut result = String::with_capacity(html.len());
     let mut in_tag = false;
 
-    for c in html.chars() {
+    for (idx, c) in html.char_indices() {
         match c {
             '<' => {
                 in_tag = true;
                 // Check for <p> tags -> newlines
-                let rest: String = html[html.len() - (html.len() - result.len())..]
-                    .chars()
-                    .take(3)
-                    .collect();
+                let rest: String = html[idx + c.len_utf8()..].chars().take(3).collect();
                 if rest.starts_with("p>") || rest.starts_with("br") {
                     result.push('\n');
                 }
@@ -393,6 +390,7 @@ mod tests {
     fn test_strip_html_tags() {
         assert_eq!(strip_html_tags("Hello <b>world</b>"), "Hello world");
         assert_eq!(strip_html_tags("a &amp; b"), "a & b");
+        assert_eq!(strip_html_tags("ab<é>xy<"), "abxy");
     }
 
     #[test]