// SPDX-License-Identifier: MIT
// Copyright (c) 2024-2026 Acme Corp.
//
// Renders a single comment. Supports inline markup (bold, italics) so users
// can format their posts. The Markdown→HTML conversion happens server-side
// and the rendered HTML is passed in via the `body` prop.
//
// DEMO FIXTURE — known insecure pattern on line 23 (XSS via unsanitised HTML).
// In production this would be sanitised with DOMPurify before reaching the DOM.
interface CommentProps {
body: string; // pre-rendered HTML from the server
stamp: string;
}
export function Comment({ body, stamp }: CommentProps) {
return (
<article className="comment">
<header>
<time>{stamp}</time>
</header>
<div
dangerouslySetInnerHTML={{ __html: body }}
/>
</article>
);
}