React DOM escapes any values

I have discussed this particular sentence with a colleague:

By default, React DOM escapes any values embedded in JSX before rendering them. Thus it ensures that you can never inject anything that’s not explicitly written in your application. Everything is converted to a string before being rendered.

https://reactjs.org/docs/introducing-jsx.html#jsx-prevents-injection-attacks

Specific these two quotes: "React DOM escapes any values embedded in JSX before rendering them" and "Everything is converted to a string before being rendered"

As far as we know, everything is assigned via a Text-node and not escaped as the first sentence describes.

Mimicked example

const test = `<script>console.log("My log")</script>`;
let body = document.querySelector('body');
let content = new Text(test);
body.appendChild(content);

從 issue 中連結的「JSX Prevents Injection Attacks」區段開始，並根據所描述的 Text-node 行為核實其中引用的兩項說法。只有在措辭不準確時才更新文件，並確保修訂後的說明準確描述 JSX 值如何進行渲染。