Do not inject unsanitized HTML
このページは日本語には対応しておりません。随時翻訳に取り組んでいます。
翻訳に関してご質問やご意見ございましたら、
お気軽にご連絡ください。
ID: javascript-browser-security/react-dangerously-inner-html
Language: JavaScript
Severity: Warning
Category: Security
CWE: 79
Description
Always sanitize HTML data before injecting it in the DOM. Use libraries such as DOMPurify before using it.
Non-Compliant Code Examples
const App = () => {
const data = `lorem <b onmouseover="alert('mouseover');">ipsum</b>`;
return (
<div
dangerouslySetInnerHTML={{__html: data}}
foobar={{foo: bar}}
>
</div>
);
}
Compliant Code Examples
const App = () => {
const data = `lorem <b onmouseover="alert('mouseover');">ipsum</b>`;
return (
<div
dangerouslySetInnerHTML={{__html: sanitize(data)}}
/>
);
}
Seamless integrations. Try Datadog Code Analysis