2 ms·
If the state comes from the user, they can add script tags into the html How is that different with React? And how is it a problem? A rendering engine wou
by TekMol 5y ago
If the state comes from the user, they
can add script tags into the html
How is that different with React?
And how is it a problem? A rendering engine would set the html of some element to the html I think?
This ...
document.body.innerHTML='<script>alert(1)</script>';
...does not execute the script.
- leonardopainter 5y ago<img src='x' onerror='alert(1)'> https://developer.mozilla.org/en-US/docs/Web/API/Element/innerHTML#security_considerations https://developer.mozilla.org/en-US/docs/Web/API/Element/inn...
- TekMol 5y agoTrue. But the same issue with reacts way.
- leonardopainter 5y agoIn terms of the placeholders in JSX, no they are escaped.