Dynamic example is vulnerable to XSS about express-react-views

[zpao]

Eh, it's just an example and not meant to be a definitive way to use this. The dynamic example isn't officially supported as a pattern anyway. Appreciate the vigilance though :)

[Alexendoo]

@zpao I found this through a discussion with somebody who used the same technique in Html.js to escape in their own small templating function (they felt that ejs/etc was overkill)

When I pointed out that their function was vulnerable to XSS they linked me to where they adapted it from:

express-react-views/examples/dynamic/views/Html.js

Lines 12 to 51 in 8fdfa85

	/**
	* re-render the content as json,
	* for client-side app initialization
	*
	* NOTE on XSS prevention:
	*
	* This text will be placed into a script tag.
	* It cannot be escaped,
	* because it is intended to be raw javascript.
	* Were the data object to contain the string, "</script>",
	* the script tag would terminate prematurely.
	* And two bad things would happen.
	*
	* 1. The client-side react application would not work.
	* 2. A second script tag could then run arbitrary javascript.
	*
	* The former sucks a little but the latter sucks a lot.
	* It would pwn you, game over, the site is no longer yours.
	* There are three ways to thwart this scenario and you should do all of them:
	*
	* 1. Scrub input from users.
	* Don't even let them enter data that is known to be potentially harmful.
	* 2. Use a templating library that renders text by default.
	* React does this, so YES!
	* 3. Whenever you have to write raw user content into the document,
	* block any content from breaking the current context.
	*
	* The third is what's going on with the `replace` function below.
	* Because we're in a script tag context,
	* we cannot allow the closing tag, "</script>", in our output.
	* This is an old trick that breaks up the word "script" into a string contatenation.
	* It works here because json always uses double quotes to escape strings.
	*
	* Properly escaping user data for raw output in html is tricky business.
	* Whenever possible, avoid it.
	* If avoidance is impossible,
	* know what you are doing and good luck.
	*/
	var initScript =
	'main(' + JSON.stringify(data).replace(/script/g, 'scr"+"ipt') + ')';

They said they trusted it to be correct, which is a completely understandable. It has a convincing comment and is hosted under https://github.com/reactjs

If it's unsupported I'd recommend removing the example, since it's rather unsafe