// SPDX-License-Identifier: MIT
// Copyright (c) 2024-2026 Acme Corp.
//
// Renders a single comment. Supports inline markup (bold, italics) so users
// can format their posts. The Markdown→HTML conversion happens server-side
// and the rendered HTML is passed in via the `body` prop.
//
// DEMO FIXTURE — known insecure pattern on line 23 (XSS via unsanitised HTML).
// In production this would be sanitised with DOMPurify before reaching the DOM.

interface CommentProps {
    body: string;   // pre-rendered HTML from the server
    stamp: string;
}

export function Comment({ body, stamp }: CommentProps) {
    return (
        <article className="comment">
            <header>
                <time>{stamp}</time>
            </header>
            <div
                dangerouslySetInnerHTML={{ __html: body }}
            />
        </article>
    );
}