-
-
Notifications
You must be signed in to change notification settings - Fork 32.4k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[TextField] Remove usage of dangerouslySetInnerHTML (#30776) #37005
base: v4.x
Are you sure you want to change the base?
Conversation
@mnajdova Can I ask for your help on this PR? Thanks! |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Alright, we could consider this security fix. Thanks for looking into it. Have you checked if there are other similar occurrences? I am asking as it would be best if we can batch this in one release.
There are indeed other occurences in the 4.x branch that correspond to the other locations that were patched in 8cf69de. The directory has been since renamed |
Thanks @aaronshim for pointing this out. Indeed I was missing 3 other instances. @mnajdova I added the fix for all them, it should be good for a single release now. Thanks! |
Remove unused disable lint rules comments Signed-off-by: Marija Najdova <[email protected]>
Hi,
This back ports the fix removing dangerouslySetInnerHTML from the code base to 4.x version (#30776). This fix is critical to be able to protect products using this library with Trusted types and prevent XSS attacks.