React 18

Apply the JavaScript ES2026 baseline first. These rules cover React 18 rendering, dangerous sinks, URLs and props, forms and effects, state trust, SSR and hydration, refs, error handling, and production dependencies.

Rendering and HTML

• Render untrusted values as JSX text in ordinary elements or inert string props such as title so React treats them as text.
• Avoid dangerouslySetInnerHTML; when rich HTML is required, sanitize once with a maintained allowlist sanitizer and pass the result only as {__html: sanitized} at the reviewed sink.
• Never concatenate trusted and untrusted fragments after sanitization or mark a raw API response as trusted markup.
• Keep untrusted values out of inline script text, style text, event-handler strings, and raw SVG or MathML markup.
• Use a per-response CSP nonce and pass it to React server streaming through the nonce option; Trusted Types enforcement does not make dangerouslySetInnerHTML content safe by itself.

URLs, props, and components

• Parse and allowlist URL schemes and origins before assigning user-derived navigation, image, iframe, or form targets.
• Do not spread untrusted objects into DOM elements or privileged components because they can set unexpected attributes and handlers.
• Map user-selected component names and variants through an exact registry rather than dynamic imports or property lookup.
• Keep secrets and authorization decisions out of client component props and public build-time environment variables.
• Treat third-party component escape hatches and HTML-rendering props as security-sensitive