Parsing html output from xss filter dosen't work

[fredrik-sogaard]

Expected Behavior

I use https://github.com/leizongmin/js-xss to do some sanitation of the my html before parsing it and making React elements. I except the sanitized html to be parsed correctly into elements.

Actual Behavior

The html I want to sanitize and parse is this:

<meta name="keywords" content="dette, introfeltet">
<meta name="description" content="Dette er introfeltet.">
<meta name="referrer" content="no-referrer-when-downgrade">
<meta name="robots" content="none">
<meta content="nb_NO" property="og:locale">
<meta content="en_EN" property="og:locale:alternate">
<meta content="nb_NO" property="og:locale:alternate">
<meta content="Samskipnaden Craft" property="og:site_name">
...

Run through the xxs filter I get this:

<meta name="keywords" content="dette, introfeltet">
<meta name="description" content="Dette er introfeltet.">
<meta name="referrer" content="no-referrer-when-downgrade">
<meta name="robots" content="none">
<meta content="nb_NO" property="og:locale">
<meta content="en_EN" property="og:locale:alternate">
<meta content="nb_NO" property="og:locale:alternate">
<meta content="Samskipnaden Craft" property="og:site_name">
...

Run through the html parser I only get at string back looking exactly like the original html—no React elements. Should the parser correctly parse sanitized html?

Parsing the original html gets me the expected React elements.

Steps to Reproduce

Install https://github.com/leizongmin/js-xss and filter some html before parsing it.

Reproducible Demo

Environment

• Version: 0.10.3
• Platform: Node / Next JS
• Browser: / Chrome 81

[remarkablemark]

Yes, that behavior is expected because xss will escape all your angle brackets. E.g., < to <.

Then when you input the string to html-react-parser, it will decode your string with HTML entities via html-dom-parser and spit out the string. It is considered escaped here since it is a string, not a JSX element.

See Repl.it demo.

I think what you're looking for is a sanitizer that strips out XSS instead of one that escapes all angle brackets.

See FAQ or #94 for more details.

[remarkablemark]

Closing issue due to inactivity. Feel free to reopen if you have something to add.