Re:C stdlib isn't threadsafe and even safe Rust didn't save us
by crooked-v on Wednesday January 22, 2025 @03:56PM
(#42797411)
In the React world, the only times I've seen dangerouslySetInnerHTML consistently used is for outputting string literal CSS content (and this one is increasingly rare as build tools need less handholding), string literal JSON content (for JSON+LD), and string literal premade scripts (i.e. pixel tags from the marketing content). That's not to say there's no danger surface there, but it's not broadly used as a tool outside of code that's either really bad or really exhaustively hand-tuned.
[ Parent
| on HN ]
Re:C stdlib isn't threadsafe and even safe Rust didn't save us
by benatkin on Wednesday January 22, 2025 @04:04PM
(#42797492)
React doesn't have a tag and attribute sanitizer built in, so having non-js-programmers edit JSX isn't especially safe anyways, as an img or a href could exfiltrate data. If it were they could just block out an innerHTML attribute. A js programmer can get around it by setting up a ref and then using the reference to set innerHTML without the word dangerously appearing.
Re:C stdlib isn't threadsafe and even safe Rust didn't save us
by koito17 on Wednesday January 22, 2025 @04:18PM
(#42797621)
> A js programmer can get around it by setting up a ref and then using the reference to set innerHTML without the word dangerously appearing.
If DOM nodes during the next render differ from what react-dom expects (i.e. the DOM nodes from the previous render), then react-dom may throw a DOMException. Mutating innerHTML via a ref may violate React's invariants, and the library correctly throws an error when programmers, browser extensions, etc. mutate the DOM such that a node's parent unexpectedly changes.
There are workarounds[1] to mutate DOM nodes managed by React and avoid DOMExceptions, but I haven't worked on a codebase where anything like this was necessary.
[1] https://github.com/facebook/react/issues/11538#issuecomment-...
Re:C stdlib isn't threadsafe and even safe Rust didn't save us
by benatkin on Wednesday January 22, 2025 @04:31PM
(#42797750)
The reference is used to operate on the subtree when wrapping libraries like CodeMirror https://github.com/uiwjs/react-codemirror/blob/master/core/s... React leaves it alone if the children doesn't change.
innerHTML is useful when there is a trusted HTML source, which is becoming more popular with stuff like HTMX and FastHTML.
Re:C stdlib isn't threadsafe and even safe Rust didn't save us
by javier2 on Wednesday January 22, 2025 @04:18PM
(#42797626)
I've only really seen dangerouslySetInnerHTML used while transitioning from certain kinds of server side rendering to React. There is still lots of really old internal tools in ancient html out there.