-
-
Notifications
You must be signed in to change notification settings - Fork 26.8k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
XSS (or parse error) in react-error-overlay
with specific coding style
#2789
Comments
react-error-overlay
with specific coding stylereact-error-overlay
with specific coding style
That's great, thanks for reporting. I expect this to be solved by the React rewrite (haven't reviewed it yet) but happy to take a fix for current code. |
Seems the source code is escaped by This is the
And this is the first section (shows
It shows that the 4th line doesn't fully parsed by |
Looks like the It maybe hard for |
Is this a bug report?
Yes
Can you also reproduce the problem with npm 4.x?
Reproduced on
5.0.3
and4.6.1
Environment
node -v
:v8.1.3
npm -v
:5.0.3
and4.6.1
yarn --version
(if you use Yarn):npm ls react-scripts
(if you haven’t ejected):react-scripts@1.0.10
Then, specify:
Steps to Reproduce
create-react-app xss-test
, thencd xss-test
npm start
and openlocalhost:3000
/XSS/
will shownExpected Behavior
It shouldn't show the checkbox, it should display the source code.
![image](https://user-images.githubusercontent.com/8115912/28199817-219475b0-689b-11e7-9282-41158d97cb89.png)
Actual Behavior
It shows the checkbox and the eval JavaScript of
![image](https://user-images.githubusercontent.com/8115912/28199869-70e3d75a-689b-11e7-9d23-cfbc23258ca1.png)
![image](https://user-images.githubusercontent.com/8115912/28199863-62b1c868-689b-11e7-9723-4b74420a0ba0.png)
onclick
attribute executed after clicked it.Reproducible Demo
https://github.com/ccloli/create-react-app-xss-example
The text was updated successfully, but these errors were encountered: