https://10alert.com/posts/why-react-didnt-kill-xss-the/