Let me show you how React applications get hacked in the real-world
summary
React is mostly safe by output-encoding text but fails on specific APIs and libraries: live demos turn a database Twitter link into javascript:alert(1) via an unencoded href attribute, and naive fixes using indexOf/toLowerCase are bypassed with control characters. A popular unmaintained component react-json-pretty with ~40k downloads renders attacker-controlled package.json and produces XSS. Automated npm audit misses it; the talk uses live coding, GitHub Copilot hiccups, and the tool Sneak to find the vulnerable code.
AI-written summary · about
chapters (8)
- 0:00React security gaps
- 2:11React not fully secure
- 3:36Secure by default in React
- 6:05Live XSS demo in React
- 9:20Href bypasses React encoding
- 14:18Manual sanitization pitfalls
- 15:43Third-party React risks
- 19:10Secure React takeaways
related talks
21mLet Me Show You How React Applications Get Hacked in the Real-World
32mLet me show you how React applications get hacked in the real-world
42mYou thought your React application is secure? Think again
50mBuilding Secure React Applications
29mHack Me if You Can
07mWhat is an XSS attack - and why should you care?
32mWriting Secure JavaScript Code
54mArchitecting Fortresses: A Deep Dive into Advanced Security Measures for ReactJS Apps