No Protections Against XSS Attacks Using innerHTML

If someone were building an app with Hyperapp and wanted to allow for formatting of user-supplied data with HTML instead of Markdown or other such syntax, using the innerHTML attribute adds a XSS vulnerability that we should probably at least warn about if not prevent entirely.

Example pen.

In React this would be prevented with the message:

Warning: Directly setting property `innerHTML` is not permitted. For more information, lookup documentation on `dangerouslySetInnerHTML`.

As the warning implies, the dangerouslySetInnerHTML attribute is React’s way of allowing the user to still do this while acknowledging how dangerous it is.

[SkaterDad]

My vote is documentation. No need to add the extra complexity in my opinion.

It’s a good candidate for “Dev mode” console warnings in the future also.

On Sun, Sep 10, 2017, 7:22 PM Jorge Bucaran [e-mail] wrote:

So, what solutions have we come up with so far?

• Disable innerHTML and give you dangerouslySetInnerHTML to do the same.
• Document using innerHTML is dangerous.

…

— You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub https://github.com/hyperapp/hyperapp/issues/360#issuecomment-328385905, or mute the thread https://github.com/notifications/unsubscribe-auth/AMpDr_0CTlLYNChCpcLICkP-z0cZnDiOks5shH1ZgaJpZM4PSbnG .

[jorgebucaran]

https://github.com/hyperapp/hyperapp/commit/3ab5a1e483fc0520447b3280c52ec67c84f66ff1

😄