Let's say I write a webapp using React only, never touching the DOM directly. I never use
dangerouslySetInnerHTML. Do I still have to worry about XSS? Or in other words, are there any other unsafe usages of React?
It would be very nice if the only thing I had to remember to keep myself safe from XSS was to not use a property with the word dangerous in it's name. But is it that simple?
I'm not counting the risk of bugs in the React engine itself here. Neither am I interested in things not directly related to React, such as the common store hydration mistake.