Potential fix for code scanning alert no. 1: DOM text reinterpreted as HTML

[EthanThePhoenix38]

Potential fix for https://github.com/ThePhoenixAgency/ThePhoenixAgency.github.io/security/code-scanning/1

In general, to fix this kind of issue you must ensure that untrusted text is not interpreted as HTML without proper escaping. Two common approaches are: (1) avoid building HTML strings with untrusted data and instead create DOM elements and assign .textContent, or (2) rigorously HTML‑escape the untrusted data before interpolation. The first approach is usually simpler and less error-prone.

For this code, the best fix without changing visible functionality is to stop interpolating text into an HTML string for user messages and instead create the message DOM structure using document.createElement, setting textContent for the user-provided text. That way, any HTML metacharacters in text are treated as literal characters. We only need to change the addUserMessage method (lines 145–161) in chatbot.js. No imports are necessary: we can use standard DOM APIs already available in the browser. Specifically, we will replace the construction of messageHTML and the insertAdjacentHTML call with: create a <div> for the message, a nested <div> for .message-content whose textContent is set to text, and a nested avatar <div> populated via innerHTML with the fixed SVG markup. Then append this container to messagesDiv. The rest of the logic (scrolling and this.messages.push) stays the same.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

[Copilot]

Pull request overview

Addresses code scanning alert #1 (“DOM text reinterpreted as HTML”) by preventing user-provided chat text from being inserted into the DOM as HTML.

Changes:

• Reworks addUserMessage to construct DOM nodes via document.createElement instead of building an HTML string.
• Uses textContent for user-provided text to avoid HTML interpretation.
• Appends the assembled message node via appendChild (maintaining existing scrolling and message tracking behavior).

Comments suppressed due to low confidence (1)

chatbot.js:224

• This statement is unreachable.

            window.open('https://calendly.com/ethanbernier/', '_blank');      case 'question':