Let me show you how React applications get hacked in the real-world
summary
Concrete exploits and demos show how React apps become XSS-prone: direct user data in attributes like href bypasses React’s default HTML encoding, control characters evade simple blocklists, and a real npm component (react-json-pretty had an XSS bug) exposes props-as-HTML. Live workflow uses a mock database, npm install / npm audit and Snyk tools including Snyk Advisor and a VS Code scanner, highlights that an npm install can pull ~79 packages from 39 maintainers, and recommends multiple scanners and automated upgrades.
AI-written summary · about
chapters (15)
- 0:00React security risks
- 1:03Why React apps get hacked
- 3:30JavaScript npm supply chain risks
- 5:35XSS in React despite defaults
- 8:05Live demo: XSS vulnerabilities
- 12:04Href pitfalls and user input
- 14:15Flawed mitigation and testing gaps
- 17:12Takeaways from React flaws
- 18:38Vulnerable npm packages and JSON parsing
- 23:12Scanning dependencies with npm audit
- 25:19Exploiting a vulnerable React JSON package
- 27:04DangerouslySetInnerHTML XSS
- 29:55Avoiding XSS in React best practices
- 30:36React security learning resources
- 31:19Final takeaways and Q&A
related talks
21mLet me show you how React applications get hacked in the real-world
21mLet Me Show You How React Applications Get Hacked in the Real-World
42mYou thought your React application is secure? Think again
50mBuilding Secure React Applications
07mWhat is an XSS attack - and why should you care?
32mWriting Secure JavaScript Code
54mArchitecting Fortresses: A Deep Dive into Advanced Security Measures for ReactJS Apps
24mStrangerDanger: Finding Security Vulnerabilities Before They Find You!