{"action":"created","issue":{"url":"https://api.github.com/repos/facebook/react/issues/3473","labels_url":"https://api.github.com/repos/facebook/react/issues/3473/labels{/name}","comments_url":"https://api.github.com/repos/facebook/react/issues/3473/comments","events_url":"https://api.github.com/repos/facebook/react/issues/3473/events","html_url":"https://github.com/facebook/react/issues/3473","id":63293013,"number":3473,"title":"How Much XSS Vulnerability Protection is React Responsible For?","user":{"login":"sebmarkbage","id":63648,"avatar_url":"https://avatars.githubusercontent.com/u/63648?v=3","gravatar_id":"","url":"https://api.github.com/users/sebmarkbage","html_url":"https://github.com/sebmarkbage","followers_url":"https://api.github.com/users/sebmarkbage/followers","following_url":"https://api.github.com/users/sebmarkbage/following{/other_user}","gists_url":"https://api.github.com/users/sebmarkbage/gists{/gist_id}","starred_url":"https://api.github.com/users/sebmarkbage/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sebmarkbage/subscriptions","organizations_url":"https://api.github.com/users/sebmarkbage/orgs","repos_url":"https://api.github.com/users/sebmarkbage/repos","events_url":"https://api.github.com/users/sebmarkbage/events{/privacy}","received_events_url":"https://api.github.com/users/sebmarkbage/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-03-20T19:50:04Z","updated_at":"2015-03-20T21:14:16Z","closed_at":null,"body":"There was a security hack that mentions React here: http://danlec.com/blog/xss-via-a-spoofed-react-element\r\n\r\nUltimately this is a server-side bug and NOT a bug in React itself. This issue is about figuring out if there is something we can do to mitigate issues when you have a JSON parsing bug or some server-side issue.\r\n\r\n## isValidElement\r\n\r\nReact is designed to work with plain objects as input, and in fact, we're even getting rid of the `_isReactElement` as a way to verify this. We'll allow any JSON object. IMO, there is no problem with the verification here.\r\n\r\nAll string values are sanitized before inserted into the DOM (except for CSS styles which is a known wontfix issue for IE8).\r\n\r\nIn earlier versions we used `instanceof` checks but that didn't work well with multiple Reacts, it makes it difficult to optimize (inline objects are much faster) and couples JSX permanently to React, which we would like to avoid.\r\n\r\n## dangerouslySetInnerHTML\r\n\r\nOne possible solution is to disable this feature and require it to be used imperatively (`React.findDOMNode(ref).innerHTML = ''`) which makes for worse performance at insertion time.\r\n\r\nHowever, I don't believe this is the only bad thing once you can insert arbitrary HTML tags. It is certainly the easiest way to gain access to XSS though. You can also insert arbitrary Web Components which could expose data. You can render form elements that can potentially pass data.\r\n\r\n## What else can we do?\r\n\r\nUltimately this is an issue where `<div>{userData}</div>` seems like a valid use case, but if your userData is compromised, it becomes dangerous.\r\n\r\nShould React be responsible for protecting itself against arbitrary JSON as children?"},"comment":{"url":"https://api.github.com/repos/facebook/react/issues/comments/84149189","html_url":"https://github.com/facebook/react/issues/3473#issuecomment-84149189","issue_url":"https://api.github.com/repos/facebook/react/issues/3473","id":84149189,"user":{"login":"yukinying","id":1326727,"avatar_url":"https://avatars.githubusercontent.com/u/1326727?v=3","gravatar_id":"","url":"https://api.github.com/users/yukinying","html_url":"https://github.com/yukinying","followers_url":"https://api.github.com/users/yukinying/followers","following_url":"https://api.github.com/users/yukinying/following{/other_user}","gists_url":"https://api.github.com/users/yukinying/gists{/gist_id}","starred_url":"https://api.github.com/users/yukinying/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/yukinying/subscriptions","organizations_url":"https://api.github.com/users/yukinying/orgs","repos_url":"https://api.github.com/users/yukinying/repos","events_url":"https://api.github.com/users/yukinying/events{/privacy}","received_events_url":"https://api.github.com/users/yukinying/received_events","type":"User","site_admin":false},"created_at":"2015-03-20T21:14:16Z","updated_at":"2015-03-20T21:14:16Z","body":"I was also having the same doubt on script tag when I saw that it was supported in facebook.github.io/react/docs/tags-and-attributes.html, and then I figured out that script tag is used in server side react and it would be executable. And indeed most style attacks only works in IE8 or minor. But it still contributes to quite some amount of traffic."}}