Let Me Show You How React Applications Get Hacked in the Real-World
summary
A live demo builds a package‑profile site and uses the unmaintained npm module react-json-pretty (40k downloads) to render package.json showing that React’s default output encoding protects text but not attributes, so href values are not output-encoded by React and a javascript: link produces XSS. Naive fixes like lowercasing or replacing with # fail once attackers add control characters. npm audit misses the issue but Snyk test flags the vulnerable component.
AI-written summary · about
chapters (6)
- 0:00Introduction to React security
- 3:27Secure by default explained
- 6:17Identifying security gaps
- 9:26Mitigation and pitfalls
- 14:47Supply chain vulnerabilities
- 19:44Final takeaways
related talks
21mLet me show you how React applications get hacked in the real-world
32mLet me show you how React applications get hacked in the real-world
42mYou thought your React application is secure? Think again
50mBuilding Secure React Applications
29mHack Me if You Can
32mWriting Secure JavaScript Code
24mStrangerDanger: Finding Security Vulnerabilities Before They Find You!
54mArchitecting Fortresses: A Deep Dive into Advanced Security Measures for ReactJS Apps