Web Security · Junior · Question 23 of 75
Why can <a href={user.website}> in React still lead to XSS?
- ✓Correct answer: A value like
javascript:alert(1)runs code when clicked, so URLs must be checked to usehttp:orhttps: - 2React doesn't escape attribute values at all
- 3Because
<a>elements always open in a new window
Explanation
Escaping protects against breaking out of the attribute, but javascript: is a valid URL scheme. Validate the protocol before using user-supplied links.