no-dangerously-set-innerhtml

Rule category

Security.

What it does

Warns when using dangerouslySetInnerHTML.

Why is this bad?

This should be used with extreme caution! If the HTML inside isn’t trusted (for example, if it’s based on user data), you risk introducing an XSS vulnerability.

Read more about using dangerouslySetInnerHTML.

Examples

Failing

import React from "react";
 
function Example() {
  return <div dangerouslySetInnerHTML={{ __html: "Hello, World!" }} />;
}