-
Notifications
You must be signed in to change notification settings - Fork 986
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Fixes #37582 - use textarea in host comment edit #10218
Conversation
added |
Nice. Thank you. |
By default, React DOM escapes any values embedded in JSX before rendering them. (https://legacy.reactjs.org/docs/introducing-jsx.html#jsx-prevents-injection-attacks) |
Oh, this is great. Thank you very much. Do we somewhere have a XSS tests which tries to inject certain JS stuff in textarea / other user-defined input fields and then tries to find out if the JS would be escaped / not espaced? |
I tested this and what happens is:
|
Not in our tests in the repo, since we use textarea from react/rails which should be secure for that.
Thanks, had a typo in the function call, should be good now |
Works now, thanks! |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Code LGTM, approving based on @nadjaheitmann's testing. thanks @MariaAga!
Had to change the css since for long inputs the comment text would go out of the card border.
Added set default on submit so if a user changes the comment, saves, and then changes it again but clicks the cancel it wont go to the value that the page loaded