In our react.js based codebase, we use an external library which accepts raw html, and we had xss issues due to code like:
'<div title="' + dangerousTitle + ' ">' + dangerousText + '</div>';
I need to come up with a policy for the team and it seemed possible to use:
ReactDOMServer.renderToStaticMarkup(
<div title={dangerousTitle}>
{dangerousText}
</div>
);
On the client side code. However, in react documentation, it is explicitly stated that renderToStaticMarkup is for server side use.
Assuming we know what we are doing, does anybody have any argument against above use?
PS: we considered _.escape, _.template with <%-, `` template strings with escaping function, above seemed the best fit since the team is already used to react templates more than anything else.
Aucun commentaire:
Enregistrer un commentaire