Open michaelrodov opened 5 years ago
It is caused by https://github.com/AllenFang/react-bootstrap-table/blob/26d07defab759e4f9bce22d1d568690830b8d9d7/src/TableBody.js#L114-L118
If you return a invalid react element, it will use dangerouslySetInnerHTML
. Your fix could be to use the following dataFormat
:
dataFormat={v => (<span>{v}</span>)}
There is now a CVE pointing at this issue. Are there plans to fix this XSS exploit?
Hi When using dataFormat function and not converting the value to react component output is not sanitised. Therefore you can easily run XSS through it.
Example: https://codesandbox.io/s/q7oj2v6xo9?fontsize=14