News for hackers. Stuff that matters.

A comment on Solid.js feels like what I always wanted React to be. Parent comment

Re:Solid.js feels like what I always wanted React to be by TekMol on Tuesday March 01, 2022 @06:27AM (#30512805) 

    If the state comes from the user, they
    can add script tags into the html
How is that different with React?

And how is it a problem? A rendering engine would set the html of some element to the html I think?

This ...

    document.body.innerHTML='<script>alert(1)</script>';
...does not execute the script.
[ Parent | on HN ]
Re:Solid.js feels like what I always wanted React to be by leonardopainter on Tuesday March 01, 2022 @06:32AM (#30512857)
<img src='x' onerror='alert(1)'>

https://developer.mozilla.org/en-US/docs/Web/API/Element/inn...

[ Parent | on HN ]
Re:Solid.js feels like what I always wanted React to be by leonardopainter on Tuesday March 01, 2022 @06:43AM (#30512944)
In terms of the placeholders in JSX, no they are escaped.
[ Parent | on HN ]
Re:Solid.js feels like what I always wanted React to be by TekMol on Tuesday March 01, 2022 @06:41AM (#30512930)
True.

But the same issue with reacts way.

[ Parent | on HN ]