Is this library secure against XSS ?

[pedro757]

Just asking

[franky47]

If you mean "does it protect you from doing things like this":

const [redirect] = useQueryState('redirect')
const router = useRouter()

useEffect(() => {
  router.replace(redirect)
}, [redirect])

Then no. A little userland logic is needed to prevent XSS. This can (and probably should) be done in a parser:

const redirectParser = createParser({
  parse(query) {
    // Very basic check
    if (query.startsWith('/') === false) {
      return null // Possible XSS
    }
    return query
  },
  serialize(value) { return value }
})

function useRedirect() {
  const [redirect] = useQueryState('redirect', redirectParser.withDefault('/'))
  return redirect
}