Making WordPress.org

Opened 3 months ago

Last modified 3 months ago

#4504 new defect

Security docs in Plugins hanbook for developing in block editor context

Reported by: manooweb Owned by:
Milestone: Priority: normal
Component: Developer Hub Keywords:



As we discussed during a #core-editor meeting on wednesday 5th June

it seems there is no guidelines about what a developer need to pay attention when he codes in javascript and espacially React technologies like that exists with PHP in the plugins handbook here https://developer.wordpress.org/plugins/security/

For example when we start and are new on these technologies we can ask ourselves some questions

  • Do I need to use JSX instead of createElement because JSX is safe?

See https://reactjs.org/docs/react-without-jsx.html
and https://reactjs.org/docs/introducing-jsx.html#jsx-prevents-injection-attacks

Is it the same because Babel compiles JSX down to React.createElement() calls?

  • What about the use of dangerouslySetInnerHtml? The block editor use it internally. What should we pay attention to when we need to use it?


  • What should we never do?

Because we don't really know where to open the issue I'm going to also open it on the Gutenberg repository on Github


Change History (1)

#1 @SergeyBiryukov
3 months ago

  • Component changed from General to Developer Hub
Note: See TracTickets for help on using tickets.