html-react-parser XSS

Testing cross-site scripting (XSS) attack in html-react-parser

by remarkablemark

HTML

<div id="root"></div>

<script src="https://unpkg.com/html-react-parser@latest/dist/html-react-parser.min.js"></script>

React

// https://github.com/remarkablemark/html-react-parser/issues/94
// https://www.owasp.org/index.php/Cross-site_Scripting_(XSS)
var html = '<img src="http://url.to.file.which/not.exist" onerror=alert()><script>alert()</' + 'script><style>body{background:skyblue}</style>';

var element = HTMLReactParser(html);
console.log(element);

ReactDOM.render(element, document.getElementById('root'));