// src/components/ChatMessage.jsx import React from 'react'; import OrderStatus from './OrderStatus'; import '../styles/ChatMessage.scss'; import formatMessageTimestamp from './utils/formatMessageTimestamp'; const ChatMessage = ({ message }) => { const { type, content, order } = message || {}; // Function to safely render HTML content const renderContent = (content) => { if (typeof content !== 'string') { return
{content}
; } // Check if content contains HTML tags const hasHtml = /<[^>]*>/g.test(content); if (hasHtml) { // Create a temporary div to parse HTML const tempDiv = document.createElement('div'); tempDiv.innerHTML = content; // Basic sanitization - remove potentially dangerous tags const dangerousTags = ['script', 'iframe', 'object', 'embed', 'form', 'input', 'button']; dangerousTags.forEach(tag => { const elements = tempDiv.getElementsByTagName(tag); while (elements.length > 0) { elements[0].parentNode.removeChild(elements[0]); } }); // Remove onclick and other event handlers const allElements = tempDiv.getElementsByTagName('*'); for (let i = 0; i < allElements.length; i++) { const element = allElements[i]; const attributes = element.attributes; for (let j = attributes.length - 1; j >= 0; j--) { const attr = attributes[j]; if (attr.name.startsWith('on') || attr.name === 'javascript:') { element.removeAttribute(attr.name); } } } return ; } return{content}
; }; return (