[GitHub] [couchdb-fauxton] Antonio-Maranhao opened a new pull request, #1407: Remove some uses of "dangeroulySetInnerHTML"

["Antonio-Maranhao (via GitHub)" <gi...@apache.org>]

Antonio-Maranhao opened a new pull request, #1407:
URL: https://github.com/apache/couchdb-fauxton/pull/1407

   ## Overview
   
   The `dangeroulySetInnerHTML` React property was being used by Notification components to allow formatting of the message by embedding HTML elements directly in the message. This flexibility can become a security issue because messages might include data provided by users (e.g. document IDs), in which case it can be used for HTML injection.
   
   This PR removes uses of `dangerouslySetInnerHTML` in the Notification components in favor of embedding the input msg as a normal React node, which then is properly sanitized by React. 
    
   ## Testing recommendations
   
   Test notifications: e.g. create or delete a document and validate the notification is still displayed.
   
   ## GitHub issue number
   
   n/a
   
   ## Related Pull Requests
   
   n/a
   
   ## Checklist
   
   - [x] Code is written and works correctly;
   - [ ] Changes are covered by tests;
   - [ ] Documentation reflects the changes;
   - [ ] Update [rebar.config.script](https://github.com/apache/couchdb/blob/main/rebar.config.script) with the correct tag once a new Fauxton release is made
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@couchdb.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

[GitHub] [couchdb-fauxton] pgj commented on pull request #1407: Remove some uses of "dangeroulySetInnerHTML"

["pgj (via GitHub)" <gi...@apache.org>]

pgj commented on PR #1407:
URL: https://github.com/apache/couchdb-fauxton/pull/1407#issuecomment-1656182525

   Nitpick: the name of the React property misses an 's' in the PR description and title sometimes, i.e. writtern as `dangeroulySetInnerHTML`.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@couchdb.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

[GitHub] [couchdb-fauxton] Antonio-Maranhao merged pull request #1407: Remove some uses of "dangerouslySetInnerHTML"

["Antonio-Maranhao (via GitHub)" <gi...@apache.org>]

Antonio-Maranhao merged PR #1407:
URL: https://github.com/apache/couchdb-fauxton/pull/1407


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@couchdb.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

[GitHub] [couchdb-fauxton] Antonio-Maranhao commented on pull request #1407: Remove some uses of "dangerouslySetInnerHTML"

["Antonio-Maranhao (via GitHub)" <gi...@apache.org>]

Antonio-Maranhao commented on PR #1407:
URL: https://github.com/apache/couchdb-fauxton/pull/1407#issuecomment-1656236995

   Fixed. Thanks @pgj 


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@couchdb.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org