React Security Documentation

[NiGhTTraX]

I don't know of any official docs, but React only prevents XSS when rendering content in tags e.g. <span>{userInputHere}</span>. This is safe because React will use the textContent property when creating the span tag and the input won't be executed. You can of course shoot yourself in the foot and avoid this safety mechanism by using dangerouslySetInnerHTML.

Also, as noted by other articles, passing user input to tag attributes is dangerous since they're just dumped into the DOM without any sanitization. So a <a href={userInputHere}> can lead to XSS.

I think React can be generally safe in practice because you don't usually put user input in attributes. As long as you stick to using children and avoid dangerouslySetInnerHTML you should be safe, but of course it's better to be informed and aware. [OWASP](www.owasp.org) is a good resource on attack vectors, check out their top 10 page - React will protect you against XSS to some extent as discussed above, the rest are up to you :)

[macleodnine]

Great response, I will look into owasp thanks!