Skip to content

[TextField] Remove usage of dangerouslySetInnerHTML (#30776)#37005

Closed
KJ202 wants to merge 3 commits intomui:v4.xfrom
KJ202:v4.x
Closed

[TextField] Remove usage of dangerouslySetInnerHTML (#30776)#37005
KJ202 wants to merge 3 commits intomui:v4.xfrom
KJ202:v4.x

Conversation

@KJ202
Copy link
Copy Markdown

@KJ202 KJ202 commented Apr 24, 2023

Hi,

This back ports the fix removing dangerouslySetInnerHTML from the code base to 4.x version (#30776). This fix is critical to be able to protect products using this library with Trusted types and prevent XSS attacks.

@zannager zannager added the scope: text field Changes related to the text field. label Apr 25, 2023
@zannager zannager requested a review from mnajdova April 25, 2023 07:10
@KJ202
Copy link
Copy Markdown
Author

KJ202 commented Apr 25, 2023

@mnajdova Can I ask for your help on this PR?
It seems that two tests are failing. They are not related to this change from what I saw.

Thanks!

@mnajdova mnajdova added the v4.x label May 4, 2023
Copy link
Copy Markdown
Member

@mnajdova mnajdova left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Alright, we could consider this security fix. Thanks for looking into it. Have you checked if there are other similar occurrences? I am asking as it would be best if we can batch this in one release.

@aaronshim
Copy link
Copy Markdown

There are indeed other occurences in the 4.x branch that correspond to the other locations that were patched in 8cf69de.

The directory has been since renamed /packages/material-ui/src -> packages/mui-material/src/ but I've manually verified that at least some of the other files in that commit also existed on the 4.x branch.

@KJ202
Copy link
Copy Markdown
Author

KJ202 commented May 5, 2023

Thanks @aaronshim for pointing this out. Indeed I was missing 3 other instances.

@mnajdova I added the fix for all them, it should be good for a single release now.

Thanks!

Comment thread packages/material-ui/src/FormHelperText/FormHelperText.js Outdated
Comment thread packages/material-ui/src/OutlinedInput/NotchedOutline.js Outdated
Comment thread packages/material-ui/src/OutlinedInput/NotchedOutline.js Outdated
Remove unused disable lint rules comments

Signed-off-by: Marija Najdova <mnajdova@gmail.com>
@ZeeshanTamboli ZeeshanTamboli requested a review from mnajdova April 27, 2024 13:06
@mj12albert
Copy link
Copy Markdown
Member

Closing as we don't publish v4.x anymore

@mj12albert mj12albert closed this Apr 15, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

scope: text field Changes related to the text field. v4.x

Projects

None yet

Development

Successfully merging this pull request may close these issues.

6 participants