XSS in tutorial example

[bls]

Hi,

There is a pretty obvious XSS in the example code -- a comment such as:

 <img onmouseover="alert(1);" src="http://www.frikipedia.es/images/thumb/d/d5/Asdsa-asdas.jpg/300px-Asdsa-asdas.jpg">

Will trigger JS exec.

There are some XSS "signposts" in the tutorial (Quote: "Remember: by using this feature you're relying on Showdown to be secure."), but ultimately this isn't setting a great example for new react developers.

Thanks - Blair.

[bls]

Oh, it seems like this is related to this: showdownjs/showdown#70 ... (i.e, the comment regarding "relying on showdown to be secure" is spot on).

[zpao]

Meh, this is far and away not the point of the tutorial. It's not production code, it's a tutorial. And we call out that by using dangerouslySetInnerHTML you are explicitly opting out of React's protection.

Thanks for calling it out, but I don't think it's worth making an effort to fix.