dillon1000/react

Commit

Only do runtime validation of tag names when createElement is not used

We introduced runtime validation of tag names because we used to generate
HTML that was supposed to be inserted into a HTML string which could've
been an XSS attack.

However, these days we use document.createElement in most cases. That
already does its internal validation in the browser which throws. We're now
double validating it. Stack still has a path where innerHTML is used and
we still need it there. However in Fiber we can remove it completely.
Browse files
Changed paths4 files
First-parent comparison
M scripts/fiber/tests-passing.txt ModifiedM src/renderers/dom/fiber/ReactDOMFiberComponent.js ModifiedM src/renderers/dom/shared/__tests__/ReactDOMComponent-test.js ModifiedM src/renderers/dom/stack/client/ReactDOMComponent.js Modified
Patch

Files changed

Rendering syntax-highlighted changes…