LibreChat/client/src/utils/validateIframe.ts

export default function validateIframe(content: string): string | boolean | null {
  const hasValidIframe =
    content.includes('<iframe role="presentation" style="') &&
    content.includes('src="https://www.bing.com/images/create');

  if (!hasValidIframe) {
    return false;
  }

  const iframeRegex = /<iframe\s[^>]*?>/g;
  const iframeMatches = content.match(iframeRegex);

  if (!iframeMatches || iframeMatches.length > 1) {
    return false;
  }

  const parser = new DOMParser();
  const parsedHtml = parser.parseFromString(content, 'text/html');

  const potentiallyHarmfulTags = ['script', 'img', 'style', 'div', 'a', 'input', 'button', 'form'];
  for (const tag of potentiallyHarmfulTags) {
    const elements = parsedHtml.getElementsByTagName(tag);

    if (elements.length > 0) {
      return false;
    }
  }

  const iframes = parsedHtml.getElementsByTagName('iframe');

  if (iframes.length !== 1) {
    return false;
  }

  const iframe = iframes[0];

  // Verify role and src attributes
  const role = iframe.getAttribute('role');
  const src = iframe.getAttribute('src');

  return role === 'presentation' && src && src.startsWith('https://www.bing.com/images/create');
}