reactjs / reactjs/react.dev

React DOM escapes any values

Open
#3,565 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
JavaScript
Stars
11.8k
Forks
7.9k
Avg merge
1d 11h
Merged PRs (30d)
11

Description

I have discussed this particular sentence with a colleague:

By default, React DOM escapes any values embedded in JSX before rendering them. Thus it ensures that you can never inject anything that’s not explicitly written in your application. Everything is converted to a string before being rendered.

https://reactjs.org/docs/introducing-jsx.html#jsx-prevents-injection-attacks

Specific these two quotes: "React DOM escapes any values embedded in JSX before rendering them" and "Everything is converted to a string before being rendered"

As far as we know, everything is assigned via a Text-node and not escaped as the first sentence describes.

Mimicked example

const test = `<script>console.log("My log")</script>`;
let body = document.querySelector('body');
let content = new Text(test);
body.appendChild(content);

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the JSX Prevents Injection Attacks section linked in the issue and verify the two quoted claims against the described Text-node behavior. Update the documentation only if the wording is inaccurate, and ensure the revised explanation accurately describes how JSX values are rendered.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript, react
Domain
documentation
Issue type
Documentation
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.