J
J
jedifa2021-09-06 16:50:37
XSS
jedifa, 2021-09-06 16:50:37

Does the dompurify library help prevent xss attacks when using dangerouslySetInnerHTML?

Please tell me, for example, html code comes from the server, you need to render it in react, rendering with dangerouslySetInnerHTML

<div dangerouslySetInnerHTML={{__html: //html который пришел с сервера}} />

but as it is written in the react documentation, dangerouslySetInnerHTML is dangerous because there may be an xss attack, I
found a video on YouTube on how to be safe and the DOMPurify library is used there,
<div dangerouslySetInnerHTML={{__html: DOMPurify.sanitize(//html который пришел с сервера)}} />

The question is, does this library completely prevent xss attacks, or is everything also unsafe?

Answer the question

In order to leave comments, you need to log in

1 answer(s)
D
Daniel Chistyakov, 2021-09-06
@jedifa

"DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG".
It was created to prevent XSS attacks related to inserting HTML directly.

Didn't find what you were looking for?

Ask your question

Ask a Question

731 491 924 answers to any question