XSS in React: dangerouslySetInnerHTML is not the only culprit
React escapes by default, but javascript: URLs and markdown libs break that. Checklist for internal apps handling user HTML.
OWASP classifies persistent and reflected XSS among classic web risks; React helps by escaping JSX but SMB teams still introduce vectors with rich text editors, embedded PDF viewers, and query params rendered unsanitized. Smashing Magazine has covered safe SPA patterns — apply them on client portals and admin dashboards.
Rules: never insert raw HTML without maintained DOMPurify or
Rules: never insert raw HTML without maintained DOMPurify or equivalent; validate URLs in href/src against allowed schemes; CSP as safety net when someone forgets sanitization. For markdown, use a renderer that disables raw HTML or filters aggressively.
Internal apps are not "low risk" — XSS on an ERP portal can
Internal apps are not "low risk" — XSS on an ERP portal can steal accounting session and approve transfers. Treat employee and customer data like public production for output encoding.
Testing: include XSS payloads in E2E tests of critical forms; DAST scanners on staging before major releases. Google Security Blog documents bypasses of obsolete sanitizers — keep dependencies current.
Secure React is team discipline, not a framework feature. Code review should flag dangerouslySetInnerHTML at crypto-mining sensitivity — allowed with justification and tests.
Operations and execution — connecting strategy with what the team ships every week.
