current community

your communities

more stack exchange communities

company blog
Stack Exchange Inbox Reputation and Badges
tour help
Software Engineering Stack Exchange is a question and answer site for professionals, academics, and students working within the systems development life cycle. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top
up vote 0 down vote favorite

According to https://www.quora.com/What-are-the-key-difference-between-ReactNative-and-NativeScript/answer/Valentin-Stoychev , "ReactNative as using the notation found in React for inlining the UI declaration in a single file." Is this supposed to mean that when writing React (or ReactNative) code you have to use inline JavaScript?

Would React therefore get blocked by default by a Content Security Policy (CSP)?

According to http://www.asd.gov.au/publications/protect/protecting_web_apps.htm :

A Content Security Policy (CSP) provides security controls which can mitigate attacks such as cross-site scripting (XSS) and other attacks based on introducing malicious or otherwise undesirable content into a web application. A CSP achieves this by specifying a whitelist of content sources for a web application that a compatible browser then enforces. A large variety of content can be controlled using a CSP including scripts, images and audio or video.

By default, a CSP also implements other mitigations beyond whitelisting content sources. The main additional mitigations are:

  • Inline JavaScript will not execute: this mitigates the most common types of XSS attacks.
  • JavaScript code will not be created from strings: this prevents attackers abusing JavaScript functionality to execute arbitrary JavaScript code.

P.S. I'm totally new to React.

share|improve this question
up vote 2 down vote accepted

No, that's a totally different thing :-) He simply meant that when you write react, you put the UI directly into the component (although you can of yourse also put it in a separate "template" file and then reuse it).

Something like this:

 class Thing extends React.Component {
     render() {
        return <div>{this.props.text}</div>
    }
 }
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.