Example of bad React dangerouslySetInnerHTML?

Question

Is there an example of misuse of dangerouslySetInnerHTML in ReactJS?

Everytime I look this up, it's just someone waving their hand and saying "cross site scripting."

I've seen dangerouslySetInnerHTML used to load CSS files with a css loading npm module:

import {stylesheet, classNames} from '../static/css/styles.css'
<Head><style dangerouslySetInnerHTML={{__html: stylesheet}} /></Head>

And I'm contemplating using dangerouslySetInnerHTML for some script tags for social media share buttons that have been causing my team trouble.

Code examples and explanations of how one would go about hacking a page with XSS would be highly appreciated!

<script dangerouslySetInnerHTML={someTextSubmittedByAUser}></script> — Mike Cluck
– Mike Cluck, Commented Jun 16, 2017 at 16:01
Simple, all you need is a < in the string you are assigning to dangerouslySetInnerHTML — styfle
– styfle, Commented Jun 16, 2017 at 16:01
Same way as any other rendering into the DOM; it's not unique to React. — Dave Newton
– Dave Newton, Commented Jun 16, 2017 at 16:03
As Dave said, this is a generic security threat, not specific to React. The OWASP has a superb cheat sheet on things you should avoid doing and how to mitigate the effects : owasp.org/index.php/DOM_based_XSS_Prevention_Cheat_Sheet — Alex. P.
– Alex. P., Commented Jun 16, 2017 at 16:55

Mike Cluck · Accepted Answer · 2017-06-16 16:04:29Z

16

<span dangerouslySetInnerHTML={someTextSubmittedByAUser}></span>

Imagine if you had a comment section on your page and someone submitted a comment with:

<script>while(1){}</script>

and you just passed that as the inner HTML to some node. Now anyone who hits a page which loads that comment will have their tab lock up.

There are far more nefarious things people can do. Copying your cookies and send them to a remote server, for example.

answered Jun 16, 2017 at 16:04

Mike Cluck

32.6k13 gold badges84 silver badges95 bronze badges

Sign up to request clarification or add additional context in comments.

1 Answer 1