medium10 pts · first answer countsweb-securityxssreact
XSS that JSX does not escape
React escapes text in JSX. Which user-supplied value can still run script here?
<a href={user.website}>{user.name}</a>Discussion 0
Join free to post in the discussion.
Related questions
- What HttpOnly doesFull Stack Developer
- Keys for rows loaded from an APIFull Stack Developer
- What HTTPS protectsFull Stack Developer
- Caching a bank statement pageFull Stack Developer
- Stored versus reflected XSSFull Stack Developer
- Writing location.hash into the pageFull Stack Developer
- Encoding user text inside HTMLFull Stack Developer
- What the Secure cookie flag doesFull Stack Developer