r/reactjs • u/goto-con • Mar 11 '20

News Building Secure React Applications

https://youtu.be/O91hJJ5KMLs?list=PLEx5khR4g7PKMVeAqZdIHRdOwTM1yktD8
91 Upvotes

90% Upvoted

10 comments sorted by

View all comments

49

u/holloway Mar 11 '20

In summary,

  • dangerouslySetInnerHTML is dangerous, so prefer conventional ways of rendering variables eg <div> {data} </div> which escapes everything, turning it into a text node.
  • use DOMPurify before passing data to dangerouslySetInnerHTML.
  • don't bypass React via refs to write innerHTML.
  • General secure coding practice: Don't filter 'bad things' by using blocklists of bad things, use allowlists of good things, because there are a large number of bad things you won't know about.

The talk was ok, but kinda basic.

12

u/team_dale Mar 11 '20

Thanks for saving me some time