Unkeyed input caution.
See original GitHub issueI find the following dev-mode warning puzzling: UNKEYED_INPUT: Unkeyed <input> detected. Consider adding a name, id, _key, or _ref attr to avoid accidental DOM recycling between different <input> types.
Could you offer a bit of background as to why this is (may be) an issue, please?
Particularly, I am finding it’s hard artificially come up with a key for all inputs, it’s unnatural to need to do so, and it’s extremely easy to forget to do so if you don’t need a key for other reasons (which, to date, I’ve never had). It seems like, on the surface, DOMVM should not try to recycle input elements if they are internally problematic.
Issue Analytics
- State:
- Created 6 years ago
- Comments:11 (6 by maintainers)
Top Results From Across the Web
Web cache poisoning just got real: How to fling evil code at ...
Kettle's research focused on looking at how it might be possible to poison caches using unkeyed inputs1 such as HTTP headers.
Read more >Web cache poisoning attacks demonstrated on major ...
... which detected unkeyed inputs in the home page. ... First, he said, organizations should "cache with caution" and if possible, ...
Read more >PRACTICAL WEB CACHE POISONING - Black Hat
Cache with caution. • Avoid unkeyed input. • Detect with Burp / Param Miner. • Then disable. • Or strip at the cache...
Read more >Web Cache Poisoning: A Tale of chaining unkeyed inputs
Web Cache Poisoning: A Tale of chaining unkeyed inputs. Hello fellow hunters, I hope you all are doing good and learning new things...
Read more >Web Cache Poisoning - Medium
After finding an unkeyed input, the next steps are to assess how much ... You should also take the following precautions when implementing ......
Read more >Top Related Medium Post
No results found
Top Related StackOverflow Question
No results found
Troubleshoot Live Code
Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start FreeTop Related Reddit Thread
No results found
Top Related Hackernoon Post
No results found
Top Related Tweet
No results found
Top Related Dev.to Post
No results found
Top Related Hashnode Post
No results found
Top GitHub Comments
one option would be to only show the warning for inputs/textareas/selects whose vnodes do not explicitly set the
value
orchecked
. this would make the warnings less chatty. you could still run into the focus problem, but at least you won’t have a wrong untracked value transfered into a recycled input, which is far more serious,maybe.
js is filled with reinvented terminology for old shit rather than adopting what already existed. polyfills? they’re called “shims” literally everywhere else.
i added the rest of the input family to the warning list in https://github.com/leeoniya/domvm/commit/69ed88538db9dae47524d1a578f85602f5b80cc1