Comment Extractor by Libor Benes (Dr. B)

Comment Extractor pulls every HTML comment out of the page you're viewing — straight from its real source — and lists it in a clean, searchable-by-eye Firefox sidebar.

Instantly see what a page's <!-- --> comments contain: developer notes, framework hydration markers, analytics wrappers, leftover debug tokens, or entire blocks of commented-out markup — the same content you'd find in View Page Source, gathered in one place, copyable and exportable, without digging through raw HTML yourself.

Built for developers auditing a page, QA and security-minded users checking for leftover notes or tracking markers, and anyone curious what a site's source reveals that the rendered page doesn't show.

🏛 About This Tool:
• Every website ships some HTML comments — some are throwaway notes, others are structural markers frameworks rely on, and some are boilerplate left behind by analytics or CMS plugins.
• Comment Extractor doesn't interpret or judge any of it: it reports exactly what's between <!-- and --> in the page's actual delivered source, trimmed of surrounding whitespace, nothing added or reworded.

📐 Desktop Sidebar Design:
🟢 Manual / 🔴 Auto Pill Switch Toggle: Manual mode (in green) extracts only when you click the button. Auto (in red) automatically re-extracts whenever you switch tabs or a tracked tab finishes loading. An about 1-2 second result display lag on Auto as the site needs time to complete full loading following tab switch.
🔍 One-Click Extraction: A single button fetches the active tab's raw source and lists every comment found.
🧾 Metadata Panel: Source URL, capture timestamp, and total comment count, always visible above the results.
📋 Copy All: Copies the metadata header plus every comment to your clipboard in one action, ready to paste anywhere.
📤 Export CSV: Saves a CSV file with one row per comment — URL and timestamp included as columns on every row — named after the page's domain and capture time.

⚙ How It Works — Source-Level, Not Screen-Level:
• When you extract, the sidebar fetches the exact URL open in your active tab and reads back its raw HTML text — a fresh request to that one page, not a scrape of the live, script-modified page you're looking at.
• Comments are located with a single, precise pattern match for HTML comment syntax, then rendered using safe, text-only methods.
• No other domain is ever contacted, nothing is sent off your device, and nothing is stored once you close the sidebar or switch tabs.

📊 What You See:
🗂 Comment Cards: Every extracted comment shown in full, monospaced, one per card.
🧾 Metadata at a Glance: Source, Captured time, and Count sit right above the results.
💬 Plain-Language Status: Clear feedback at every step — fetching, found N comments, or exactly why nothing was found.
✨ Bright, High-Contrast Theme: Neon accents on a dark background, built for quick scanning.

🖥 Features:
🔎 One-Click Extraction — Every HTML comment from the page's real, delivered source.
🟢🔴 Manual / Auto Mode — Extract on demand, or let the sidebar keep results current as you browse.
📋 Copy All — Source, timestamp, count, and every comment, copied in one action.
📤 CSV Export — A structured file you can open in a spreadsheet, named for the domain and capture time.
🪶 Zero Overhead — Four small files; nothing runs while the sidebar is closed.
🔒 Client-Side Processing — All parsing and formatting happen in your browser.

🎯 Perfect For:
• Developers checking what a page ships in its HTML comments.
• QA and security-minded users scanning for leftover debug notes or tracking markers.
• Anyone curious what a site's source reveals beyond what's rendered on screen.

🔒 Security-First Architecture:
✅ No Data Collection — Explicitly declared in manifest.json.
✅ No Telemetry — No analytics, no tracking, no third-party requests of any kind.
✅ No eval() or innerHTML — Results are built with safe, text-only DOM methods.
✅ Validated Input — Every URL is checked for http:/https: before any fetch is attempted; unsupported pages are rejected with a clear message.
✅ Minimal, Purpose-Bound Permissions — Every permission requested maps directly to a visible feature (see Technical Details).
✅ Flat, Auditable Codebase — Four files total: manifest, sidebar HTML, sidebar JS, one stylesheet.

🛠 Technical Details:
• Compatibility: Firefox 140.0+ Desktop only.
• Runtime Execution RAM Footprint: ~13 KB (core scripts: manifest.json + sidebar.html + style.css + sidebar.js).
• Total Extension Download/Install Size: ~36 KB (including README.md).
• Entry point: sidebar_action panel (sidebar.html).
• Network requests: One fetch per extraction, to the exact URL of the active tab only — no other domain is ever contacted.
• Storage: None. Results live in memory only and clear when the tab changes or the sidebar closes.
• Permissions requested: activeTab (access to the tab you're viewing), tabs (read the active URL and detect tab/page changes for Auto mode), clipboardWrite (for Copy All), and the <all_urls> host permission (required to fetch a page's source across origins).
• Data Collection: None (explicitly declared).

⚠ Limitations:
🖥 Desktop Only — Firefox sidebars are not available on Android.
🔤 HTML Comments Only — Extracts <!-- --> style comments from the page's markup. It does not extract // or /* */ style comments from inside <script> blocks or linked .js/.css files.
📄 Source Snapshot, Not Live DOM — Extraction re-fetches the page rather than reading your tab's current, JavaScript-modified DOM. Comments present in the original server response are captured reliably; comments injected purely by client-side script after load, with no trace in the original HTML, are not.
🔑 Authenticated or Personalized Pages — The re-fetch is a fresh request and may not carry your tab's session or personalization. On login-gated pages, the fetched source can differ from what's rendered in your tab, or the fetch may fail outright.
🚫 Unsupported Page Types — about:, file:, view-source:, and moz-extension: pages cannot be fetched; only http: and https: pages are supported.
🔁 No De-duplication or Noise Filtering — Repeated framework or tracking boilerplate is listed exactly as many times as it appears, with no built-in filtering yet.
📶 Auto Mode Network Activity — With Auto mode on, a new fetch happens on every tab switch or completed page load of the active tab. Nothing leaves your device, but this is more background activity than Manual mode, by design, only while enabled.
🕵 Not a Security Scanner — Comments are surfaced as-is; the extension does not evaluate or flag sensitive content. That judgment is left to the user.
🧩 Malformed HTML — On pages with invalid or unusually nested comment syntax (rare in practice), extraction follows the standard first--->-closes rule, which can occasionally split one intended comment into more than one entry.

⚠ Legal Disclaimer:
Comment Extractor is an independent browser extension, not affiliated with, endorsed by, or responsible for the content of any website it is used on. Users are responsible for complying with the terms of service of any site they inspect and with applicable laws.