google / google/react-schemaorg
Consider not using dangerouslySetInnerHTML
- Lingua principale
- TypeScript
- Stelle
- 521
- Fork
- 20
- Metriche di merge delle PR
- Nessuna PR unita negli ultimi 30g
Descrizione
Thank you for this package, I came across it following this issue: https://github.com/google/react-schemaorg/issues/9, as I'm still learning about `dangerouslySetInnerHTML` and XSS.
I noticed that this package uses `dangerouslySetInnerHTML`:
```js
```
---
In order to modify `head` on the website I'm working on, I use https://github.com/staylor/react-helmet-async which is an improved fork of https://github.com/nfl/react-helmet, for React 16+.
I noticed https://github.com/nfl/react-helmet readme has an example for `JSON-LD` which doesn't use `dangerouslySetInnerHTML`:
```js
<Helmet>
{/* inline script elements */}
<script type="application/ld+json">{`
{
"@context": "http://schema.org"
}
`}
```
(please note that I added the first and last lines to make the example shorter)
I suppose in the case of https://github.com/google/react-schemaorg, such a syntax (not using `dangerouslySetInnerHTML`) wasn't followed because it has constraints:
- it requires to call `renderStatic` on the server for https://github.com/nfl/react-helmet, or
- it requires to provide `HelmetProvider` for https://github.com/staylor/react-helmet-async
I suppose https://github.com/google/react-schemaorg is aiming for simplicity and not using any `Helmet` package for this reason.
---
**If within a project we have the choice then what would you recommend please?**
Option a)
```js
<script type="application/ld+json">{JSON.stringify(this.props.item, safeJsonLdReplacer, this.props.space)}
```
Thank you in advance for your time!
Guida per i contributori
Apri la guida per i contributori
Direzione di ricerca
Non sono indicati né file del repository né test. Inizia esaminando il componente che esegue il rendering dello snippet JSON-LD e gli esempi React Helmet collegati; determina il comportamento di rendering previsto lato server e lato client e se sia fattibile sostituire dangerouslySetInnerHTML. Il completamento dovrebbe includere un approccio deciso e la convalida delle implicazioni sulla sicurezza.
Scritto dal modello di indicizzazione a partire dal testo della issue.
Valutazione
- Stack tecnologico
- react, typescript
- Ambito
- frontend, security
- Tipo di issue
- Refactoring
- Difficoltà
- 5/5
- Tempo stimato
- Più di una settimana
- Stato di attività
- Ferma
- Chiarezza
- Da chiarire
- Idoneità per principianti
- 25/100