Web Security · Senior · Question 16 of 75
In a design system, a <RichText html={...} /> component wraps dangerouslySetInnerHTML. What's the most robust approach?
- ✓Correct answer: Sanitize inside the component (or accept only a branded "sanitized" type) so callers can't pass raw strings
- 2Rename the prop to
safeHtml - 3Add a comment asking developers to sanitize before calling it
Explanation
Putting the safety check at the single sink makes the safe path the default. Types and lint rules can block direct dangerouslySetInnerHTML elsewhere.