React 19

Apply the JavaScript ES2026 baseline first. These rules cover React 19.

Rendering and HTML

• Render untrusted values as JSX text or inert string props such as title; string URL or HTML props still need validation or sanitization.
• Avoid dangerouslySetInnerHTML. For required rich HTML, sanitize once with a maintained allowlist sanitizer and pass it only as {__html: sanitized} at the reviewed sink; never concatenate after sanitizing or treat raw API responses as trusted markup.
• Keep untrusted values out of inline script/style text, event-handler strings, and raw SVG or MathML.
• Pass a per-response CSP nonce to server streaming via the nonce option; Trusted Types enforcement alone doesn't make dangerouslySetInnerHTML safe.
• Under require-trusted-types-for 'script', check your minor: 19.3.0+ passes TrustedHTML and TrustedScriptURL to DOM attributes unconverted, while 19.0 through 19.2 stringify them. On those minors, test each attribute sink under enforcement; never fix violations with a pass-through default policy.

URLs, props, and components

• Parse and allowlist URL schemes and origins before assigning user-derived navigation, image, iframe, or form targets.
• Never spread untrusted objects into DOM elements or privileged components, which can set unexpected attributes and handlers; map user-selected components and variants through an exact registry, not dynamic imports or property lookup.
• Keep secrets and authorization decisions out of client component props and public build-time variables; treat third-party escape hatches and