sanitize javascript: urls for <object> tags - #29808
Merged
Merged
Conversation
|
The latest updates on your projects. Learn more about Vercel for Git ↗︎
|
sebmarkbage
reviewed
Jun 7, 2024
Contributor
Author
|
My open question is if we have preferred behavior of |
Contributor
|
What does
The goal is to not accidentally load current page URL a second time for no good reason. |
Contributor
|
Seems like you have some failing tests too. |
React 19 added sanitization for `javascript:` URLs for `href` properties on various tags. This PR also adds that sanitization for `<object>` tags as well that Firefox otherwise executes.
Contributor
Author
|
Tests pass now. Implemented removing the string removal to match general empty string behavior. I couldn't repro the behavior of re-requesting the page either with imgs or object tags, maybe I'm missing something or it doesn't show up in the network panel. Had a repro in this sandbox: https://codesandbox.io/p/sandbox/upbeat-hofstadter-dvmlwv?file=%2Findex.html%3A12%2C1 |
Collaborator
It seems like Chrome (and possibly other browsers?) are no longer trying to render an image with an empty |
sebmarkbage
approved these changes
Jun 14, 2024
This was referenced Jul 25, 2024
anuragnedunuri
added a commit
to anuragnedunuri/CheatSheetSeries
that referenced
this pull request
Sep 23, 2026
Correct inaccurate claims: - React 19 sanitizes javascript: URLs in href, src, action, formAction, data and xlinkHref; 16.9-18 warn in development only (react/react#29808) - DOMPurify runs in Node.js with jsdom; sanitize-html offered as the no-jsdom alternative - Cite precacheFiberNode in ReactDOMComponentTree.js for fiber-tree access and the correct Princeton session-replay study; the React DevTools page did not support the claim - State that React sanitizes nothing on any path; ref writes and dangerouslySetInnerHTML carry identical risk - Replace the unimplementable "release values immediately" guidance with no long-lived credentials in client state and Web Worker isolation - Fix the URL validation helper, which rejected every relative URL; render the normalized href and fall back to plain text - Note that httpOnly protects cookie confidentiality only and does not stop XSS riding the session - Correct CR/LF response splitting: Node and the Headers API reject it; repoint to redirect validation - Await params in the Server Component example for Next.js 15 Remove duplication per rule 4: - Link the Next.js Security Cheat Sheet for Server Actions, routing-layer authorization, server-only and NEXT_PUBLIC_, per the scope split agreed with jharvieux - Link Session Management, Authorization, SSRF Prevention, Forgot Password and Unvalidated Redirects rather than restating their guidance - Drop the supply-chain section as not React-specific, per randomstuff Add and fix: - Content Security Policy section, including worker-src and development versus production policy differences - Citations in the Introduction and Authentication sections to meet the AGENTS.md per-H2 citation floor - SANITIZE_NAMED_PROPS for DOM clobbering; destructuring-first guidance for spread syntax with a per-component allow-list - Threat-model scoping statement in Sensitive Data Exposure - Wrap all snippets in components so they compile; remove em dashes and apply "spread syntax" terminology for textlint
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
sanitize javascript: urls for tags
React 19 added sanitization for
javascript:URLs forhrefproperties on various tags. This PR also adds that sanitization for<object>tags as well that Firefox otherwise executes.