4 ms·
We called it that way in React in order to call out attention to the fact that it was actually dangerous. React also properly escapes everything else it prints.
by vjeux 8y ago
We called it that way in React in order to call out attention to the fact that it was actually dangerous. React also properly escapes everything else it prints.
The app isn't using React but jQuery, which doesn't have those protections.
- deleted 8y ago[deleted]
- archgoon 8y agoThis doesn't seem to be true, here's the v1.10.0 code: https://github.com/signalapp/Signal-Desktop/blob/f6eb745632ce87eabce93d3c12f66f0bc6146d2d/ts/components/conversation/Quote.tsx#L114 https://github.com/signalapp/Signal-Desktop/blob/f6eb745632c... They do seem to be using react, and using dangerouslySetInnerHTML. Now that said, I haven't confirmed that this is the code that caused the issue, but it is in the Quotes component, which is referenced in the article. They seem to have fixed this specific issue a few days ago (v.11.0): https://github.com/signalapp/Signal-Desktop/blob/0d00fbfb7a23a9b05ea9e0c74910d31a27e710de/ts/components/conversation/Quote.tsx https://github.com/signalapp/Signal-Desktop/blob/0d00fbfb7a2... They do seem to be using jQuery elsewhere in the code base, but I'm not familiar enough to determine how it all fits together.
- ddtaylor 8y agoThey are using many frameworks mixed together like jQuery, React, and underscore.
- vjeux 8y agoOh sorry you are right! I was reading the comment ( https://news.ycombinator.com/item?id=17097501 https://news.ycombinator.com/item?id=17097501 ) which said that the issue was caused with $.html