I agree with you in principle, Malte, but in this case I want the filter to remove all of the incoming HTML and just leave the text, and that would be a bit drastic for a server-side filter.
It turns out that HTMLTidy has been superceded by SuperClean (http://xinha.python-hosting.com/wiki/SuperClean). I've tried it and it sort of works, but trying to use the Tidy option removes everything including the text, a tiny bit *too* tidy. :) I think this is because it wants to call Tidy via PHP, which is not going to work from xowiki.
The plugin I tried to implement, but could not get working, is here: http://xinha.python-hosting.com/ticket/349
The idea is to trap the paste command and instead of having the user paste directly into the text box, have them paste into a popup box instead. The code behind the box will strip all HTML out of the pasted text before passing it on to the real paste handler. Although I dislike popups I was willing to give it a try, but I could not get the popup to happen. No errors of any kind, it just didn't work.
Any other thoughts/suggestions?