leocrm/frontend/src/components/comm/blocks/HtmlBlock.tsx

// TODO: P3-F21 — Remove redundant regex before DOMPurify
import React from 'react';
import DOMPurify from 'dompurify';
import type { MessageBlock } from '@/store/commStore';

interface HtmlBlockProps {
  block: MessageBlock;
}

const HtmlBlock: React.FC<HtmlBlockProps> = ({ block }) => {
  const rawHtml: string = block.block_data.html || '';

  if (!rawHtml) {
    return null;
  }

  // Replace javascript: URLs in href attributes before sanitizing
  const safeHtml = rawHtml.replace(
    /href\s*=\s*(["'])\s*javascript:[^"']*\1/gi,
    'href=$1#$1'
  );

  const sanitized = DOMPurify.sanitize(safeHtml);

  return (
    <div
      className="prose prose-sm max-w-none text-inherit"
      dangerouslySetInnerHTML={{ __html: sanitized }}
    />
  );
};

export default HtmlBlock;