# Security Issues
## Controlling element type
The `createElement` function accepts a string in the `type` argument. If the string is controlled by a user it would be possible to create an arbitrary React component:
```javascript
// Dynamically create an element from a string stored in the backend
// stored_value is a user-controlled string
element_name = stored_value;
React.createElement(element_name, null);
```
However, this would result only in a plain, attribute-less HTML element (pretty useless).
## Injecting props
The `createElement` function accepts a list of attributes in the `props` argument. If the list is controlled by a user it would be possible to inject arbitrary props into the new element:
```javascript
// Parse user-supplied JSON and pass the resulting object as props
// stored_value is a user-controlled JSON string with attributes
props = JSON.parse(stored_value);
React.createElement("span", props);
```
You can use the following payload to set the `dangerouslySetInnerHTML` attribute:
```javascript
{"dangerouslySetInnerHTML" : { "__html": "" }}
```
## Explicitly setting dangerouslySetInnerHTML
If a user-supplied data is used to set the `dangerouslySetInnerHTML` attribute you can insert arbitrary JavaScript code:
```javascript
```
## Explicitly setting href
If a user-supplied data is used to set the `href` attribute you can insert a `javascript:` URL:
```javascript
Link
```
Some other attributes such as `formaction` in HTML5 buttons or HTML5 imports also can be vulnerable:
```javascript
// HTML5 button