fix(react-provider): prevent XSS theme vulnerability during SSR#35717
Open
Hotell wants to merge 6 commits intomicrosoft:masterfrom
Open
fix(react-provider): prevent XSS theme vulnerability during SSR#35717Hotell wants to merge 6 commits intomicrosoft:masterfrom
Hotell wants to merge 6 commits intomicrosoft:masterfrom
Conversation
📊 Bundle size report
Unchanged fixtures
|
|
Pull request demo site: URL |
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
| @@ -0,0 +1,7 @@ | |||
| { | |||
There was a problem hiding this comment.
🕵🏾♀️ visual changes to review in the Visual Change Report
vr-tests-react-components/Charts-DonutChart 2 screenshots
| Image Name | Diff(in Pixels) | Image Type |
|---|---|---|
| vr-tests-react-components/Charts-DonutChart.Dynamic - Dark Mode.default.chromium.png | 7530 | Changed |
| vr-tests-react-components/Charts-DonutChart.Dynamic - RTL.default.chromium.png | 5570 | Changed |
vr-tests-react-components/Positioning 2 screenshots
| Image Name | Diff(in Pixels) | Image Type |
|---|---|---|
| vr-tests-react-components/Positioning.Positioning end.chromium.png | 601 | Changed |
| vr-tests-react-components/Positioning.Positioning end.updated 2 times.chromium.png | 503 | Changed |
dmytrokirpa
approved these changes
Feb 3, 2026
Member
|
@Hotell can we sanitize for SSR only (where we invoke |
Contributor
Author
yup insertRule sanitizes this by default.
I wanted to do that initially but this is a public api that we expose and if used incorrectly in user land, they will get the same exploit. From runtime perf POV it should be minimal as the regex is run only on the final string, while yes I'm fine moving it to the danger insertion though. thoughts ? |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Previous Behavior
during SSR we use
dangerouslySetInnerHTMLto inject style rules created from usedthemewhich are not sanitized https://github.com/microsoft/fluentui/blob/master/packages/react-components/react-provider/library/src/components/FluentProvider/renderFluentProvider.tsx#L48.New Behavior
blocks injection of HTML termination sequences like
</style>mitigating XSS attacks in SSR scenarios wherethemeinjection could come from various sources (URL, theme customization by 3rd party etc )Related Issue(s)