React DOM escapes any values
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 11.8k
- Forks
- 7.9k
- Avg merge
- 1d 11h
- Merged PRs (30d)
- 11
Description
I have discussed this particular sentence with a colleague:
By default, React DOM escapes any values embedded in JSX before rendering them. Thus it ensures that you can never inject anything that’s not explicitly written in your application. Everything is converted to a string before being rendered.
https://reactjs.org/docs/introducing-jsx.html#jsx-prevents-injection-attacks
Specific these two quotes: "React DOM escapes any values embedded in JSX before rendering them" and "Everything is converted to a string before being rendered"
As far as we know, everything is assigned via a Text-node and not escaped as the first sentence describes.
Mimicked example
const test = `<script>console.log("My log")</script>`;
let body = document.querySelector('body');
let content = new Text(test);
body.appendChild(content);
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the JSX Prevents Injection Attacks section linked in the issue and verify the two quoted claims against the described Text-node behavior. Update the documentation only if the wording is inaccurate, and ensure the revised explanation accurately describes how JSX values are rendered.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, react
- Domain
- documentation
- Issue type
- Documentation
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100