[wp-trac] [WordPress Trac] #47501: Security docs in Plugins hanbook for developing in block editor context

[WordPress Trac]

#47501: Security docs in Plugins hanbook for developing in block editor context
-------------------------+-----------------------------
 Reporter:  manooweb     |      Owner:  (none)
     Type:  enhancement  |     Status:  new
 Priority:  normal       |  Milestone:  Awaiting Review
Component:  General      |    Version:
 Severity:  normal       |   Keywords:
  Focuses:               |
-------------------------+-----------------------------
 Hello,

 As we discussed during a #core-editor meeting on wednesday 5th June
 https://wordpress.slack.com/archives/C02QB2JS7/p1559741727071700

 it seems there is no guidelines about what a developer need to pay
 attention when he codes in javascript and espacially React technologies
 like that exists with PHP in the plugins handbook here
 https://developer.wordpress.org/plugins/security/

 For example when we start and are new on these technologies we can ask
 ourselves some questions

 - Do I need to use JSX instead of createElement because JSX is safe?

 See https://reactjs.org/docs/react-without-jsx.html
 and https://reactjs.org/docs/introducing-jsx.html#jsx-prevents-injection-
 attacks

 Is it the same because Babel compiles JSX down to React.createElement()
 calls?

 - What about the use of dangerouslySetInnerHtml? The block editor use it
 internally. What
   should we pay attention to when we need to use it?

 https://reactjs.org/docs/dom-elements.html#dangerouslysetinnerhtml

 - What should we never do?


 Because we don't really know where to open the issue I'm going to also
 open it on the Gutenberg repository on Github

 Regards

-- 
Ticket URL: <https://core.trac.wordpress.org/ticket/47501>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform