https://worldofsoftware.org/why-react-didnt-kill-xss-the-new-javascript-injection-playbook/