Potential fix for code scanning alert no. 1: DOM text reinterpreted as HTML

[EthanThePhoenix38]

Potential fix for https://github.com/ThePhoenixAgency/ThePhoenixAgency.github.io/security/code-scanning/1

In general, to fix this class of problem, you must ensure that untrusted text is not interpreted as HTML. Either (1) never build HTML strings with untrusted data and instead construct DOM nodes and assign untrusted content via textContent, or (2) sanitize/encode the untrusted text before inserting it into the DOM with HTML-parsing APIs.

The best fix here, without changing existing functionality, is to stop using insertAdjacentHTML for messages that contain untrusted text, and instead build the message DOM structure with document.createElement. Then assign the user-controlled text via textContent on the .message-content node. This preserves the visual layout and behavior while ensuring that any <script>, <img onerror=...>, or other markup in user input is treated purely as text, not executable HTML. We should apply the same pattern to addBotMessage as well, because future changes might pass user-influenced data into that method. Concretely:

• In addUserMessage, replace template literal messageHTML + insertAdjacentHTML with DOM creation: create the outer .chatbot-message user div, the .message-content div, set its textContent to text, create the avatar div and its SVG, then append everything and call appendChild.
• In addBotMessage, similarly replace the HTML string + insertAdjacentHTML with DOM construction and set .message-content.textContent = text.

All required APIs (document.createElement, appendChild, textContent, innerHTML for static SVG) are standard browser APIs, so no imports are needed, and all changes stay inside chatbot.js in the provided regions.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

[Copilot]

Pull request overview

This PR fixes a DOM-based XSS vulnerability (code scanning alert #1) in the chatbot functionality by preventing user-supplied text from being interpreted as HTML. The fix replaces string interpolation with insertAdjacentHTML with safe DOM manipulation using textContent.

Changes:

• Refactored addBotMessage() to create DOM elements programmatically and use textContent for message content
• Refactored addUserMessage() to create DOM elements programmatically and use textContent for message content

Comments suppressed due to low confidence (1)

chatbot.js:229

• This statement is unreachable.

          window.open('https://calendly.com/ethanbernier/nouveau-creneau/', '_blank');