question-mark
Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Unkeyed input caution.

See original GitHub issue

I find the following dev-mode warning puzzling: UNKEYED_INPUT: Unkeyed <input> detected. Consider adding a name, id, _key, or _ref attr to avoid accidental DOM recycling between different <input> types.

Could you offer a bit of background as to why this is (may be) an issue, please?

Particularly, I am finding it’s hard artificially come up with a key for all inputs, it’s unnatural to need to do so, and it’s extremely easy to forget to do so if you don’t need a key for other reasons (which, to date, I’ve never had). It seems like, on the surface, DOMVM should not try to recycle input elements if they are internally problematic.

Issue Analytics

  • State:closed
  • Created 6 years ago
  • Comments:11 (6 by maintainers)

github_iconTop GitHub Comments

1reaction
leeoniyacommented, Jul 13, 2017

one option would be to only show the warning for inputs/textareas/selects whose vnodes do not explicitly set the value or checked. this would make the warnings less chatty. you could still run into the focus problem, but at least you won’t have a wrong untracked value transfered into a recycled input, which is far more serious,

maybe.

0reactions
leeoniyacommented, Jul 14, 2017

I still don’t like “recycling” to refer to this mechanism

js is filled with reinvented terminology for old shit rather than adopting what already existed. polyfills? they’re called “shims” literally everywhere else.

i added the rest of the input family to the warning list in https://github.com/leeoniya/domvm/commit/69ed88538db9dae47524d1a578f85602f5b80cc1

Read more comments on GitHub >

github_iconTop Results From Across the Web

Web cache poisoning just got real: How to fling evil code at ...
Kettle's research focused on looking at how it might be possible to poison caches using unkeyed inputs1 such as HTTP headers.
Read more >
Web cache poisoning attacks demonstrated on major ...
... which detected unkeyed inputs in the home page. ... First, he said, organizations should "cache with caution" and if possible, ...
Read more >
PRACTICAL WEB CACHE POISONING - Black Hat
Cache with caution. • Avoid unkeyed input. • Detect with Burp / Param Miner. • Then disable. • Or strip at the cache...
Read more >
Web Cache Poisoning: A Tale of chaining unkeyed inputs
Web Cache Poisoning: A Tale of chaining unkeyed inputs. Hello fellow hunters, I hope you all are doing good and learning new things...
Read more >
Web Cache Poisoning - Medium
After finding an unkeyed input, the next steps are to assess how much ... You should also take the following precautions when implementing ......
Read more >

github_iconTop Related Medium Post

No results found

github_iconTop Related StackOverflow Question

No results found

github_iconTroubleshoot Live Code

Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free

github_iconTop Related Reddit Thread

No results found

github_iconTop Related Hackernoon Post

No results found

github_iconTop Related Tweet

No results found

github_iconTop Related Dev.to Post

No results found

github_iconTop Related Hashnode Post

No results found