Share this article
Security in a Component Library: href Validation and CSV Injection
React 18 renders a javascript: URL verbatim, so a CMS-fed link is a stored-XSS vector. And a CSV cell starting with = can execute in Excel. Two real attack paths a UI library should close for you.
vivekkumarsingh.in/blog/vivekui-security-href-csv-injection
Copy link
https://vivekkumarsingh.in/blog/vivekui-security-href-csv-injection
Share on social media
Cross-post to blogging platforms
Clicking any platform copies the canonical URL to your clipboard and opens the editor. Paste it as the article's canonical URL to keep all SEO signals on this domain.
More on this subject: Modern Web Development.
VivekUI91 accessible React components, 6 pure-SVG charts and 12 page templates, with no runtime dependencies at all. One install, one CSS import, no Tailwind and no config. Here is what VivekUI is, who it is for, and where it deliberately does not compete.
9 min read
VivekUIA complete setup walkthrough: installing the package, the single CSS import and where it goes, the first component, and the three mistakes that account for almost every setup issue. Works in React 18 and 19.
8 min read
VivekUIshadcn/ui hands you the source and the maintenance with it. VivekUI is a normal npm dependency you update. An honest comparison of both models, including the cases where copy-paste genuinely wins.
10 min read