feat: Unified Messaging System — kommunikation plugin, AI/Proactive/System participants, MessageSidebar, Rich Content Renderer

Phase 1: Backend plugin kommunikation (13 files, 10 tables, REST API, WebSocket, RBAC, DMS Bridge, Participant Registry, Mini-App Registry, Search Provider) Phase 2: AI plugins as participants (ai_assistant + ai_proactive dock as participants, heartbeat job) Phase 3: system_notif plugin (system events → chat messages, pinned System room) Phase 4: Frontend MessageSidebar (replaces AISidebar, same design, comm API client, WebSocket hook, commStore) Phase 5: Rich Content Block Renderer (11 components: Markdown, HTML, Image, Audio, Video, File, ActionCard, ContactCard, MiniApp, BlockRenderer) BasePlugin: added services property + _container in on_activate
2026-07-22 01:22:15 +02:00
parent 5980d38c66
commit cc3ac9a43d
45 changed files with 8154 additions and 113 deletions
@@ -0,0 +1,45 @@
+import React from 'react';
+import type { MessageBlock } from '@/store/commStore';
+
+interface HtmlBlockProps {
+  block: MessageBlock;
+}
+
+/**
+ * Basic HTML sanitization: removes <script> tags and event handler attributes.
+ * This is a minimal sanitizer — for production use DOMPurify or similar.
+ */
+function sanitizeHtml(html: string): string {
+  let sanitized = html;
+  // Remove <script>...</script> blocks (including content)
+  sanitized = sanitized.replace(/<script\b[^<]*(?:(?!<\/script>)<[^<]*)*<\/script>/gi, '');
+  // Remove <script ...> self-referencing or incomplete tags
+  sanitized = sanitized.replace(/<script\b[^>]*>/gi, '');
+  // Remove on* event handler attributes (onclick, onload, onerror, etc.)
+  sanitized = sanitized.replace(/\son\w+\s*=\s*"[^"]*"/gi, '');
+  sanitized = sanitized.replace(/\son\w+\s*=\s*'[^']*'/gi, '');
+  sanitized = sanitized.replace(/\son\w+\s*=\s*[^\s>]+/gi, '');
+  // Remove javascript: URLs in href/src
+  sanitized = sanitized.replace(/(href|src)\s*=\s*"javascript:[^"]*"/gi, '$1="#"');
+  sanitized = sanitized.replace(/(href|src)\s*=\s*'javascript:[^']*'/gi, '$1="#"');
+  return sanitized;
+}
+
+const HtmlBlock: React.FC<HtmlBlockProps> = ({ block }) => {
+  const rawHtml: string = block.block_data.html || '';
+
+  if (!rawHtml) {
+    return null;
+  }
+
+  const sanitized = sanitizeHtml(rawHtml);
+
+  return (
+    <div
+      className="prose prose-sm max-w-none text-inherit"
+      dangerouslySetInnerHTML={{ __html: sanitized }}
+    />
+  );
+};
+
+export default HtmlBlock;