Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[TextField] Remove usage of dangerouslySetInnerHTML (#30776) #37005

Open
wants to merge 3 commits into
base: v4.x
Choose a base branch
from

Conversation

KJ202
Copy link

@KJ202 KJ202 commented Apr 24, 2023

Hi,

This back ports the fix removing dangerouslySetInnerHTML from the code base to 4.x version (#30776). This fix is critical to be able to protect products using this library with Trusted types and prevent XSS attacks.

@zannager zannager added the component: text field This is the name of the generic UI component, not the React module! label Apr 25, 2023
@zannager zannager requested a review from mnajdova April 25, 2023 07:10
@KJ202
Copy link
Author

KJ202 commented Apr 25, 2023

@mnajdova Can I ask for your help on this PR?
It seems that two tests are failing. They are not related to this change from what I saw.

Thanks!

@mnajdova mnajdova added the v4.x label May 4, 2023
Copy link
Member

@mnajdova mnajdova left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Alright, we could consider this security fix. Thanks for looking into it. Have you checked if there are other similar occurrences? I am asking as it would be best if we can batch this in one release.

@aaronshim
Copy link

There are indeed other occurences in the 4.x branch that correspond to the other locations that were patched in 8cf69de.

The directory has been since renamed /packages/material-ui/src -> packages/mui-material/src/ but I've manually verified that at least some of the other files in that commit also existed on the 4.x branch.

@KJ202
Copy link
Author

KJ202 commented May 5, 2023

Thanks @aaronshim for pointing this out. Indeed I was missing 3 other instances.

@mnajdova I added the fix for all them, it should be good for a single release now.

Thanks!

Remove unused disable lint rules comments

Signed-off-by: Marija Najdova <[email protected]>
@ZeeshanTamboli ZeeshanTamboli requested a review from mnajdova April 27, 2024 13:06
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
component: text field This is the name of the generic UI component, not the React module! v4.x
Projects
None yet
Development

Successfully merging this pull request may close these issues.

5 participants