Handling ID attributes?

[ben-eb]

Thanks for the module. 👍

I was wondering if it would be possible for remark-react to handle the id attribute, so that it can be used alongside plugins such as https://github.com/wooorm/remark-slug & https://github.com/ben-eb/remark-autolink-headings. Right now, I have to use dangerouslySetInnerHTML so that I can work around this issue, but would much prefer that it would be handled here.

[tmcw]

Main concern here is DOM Clobbering, which is a very possible attack if we accept user-submitted IDs. If we support IDs they'll likely have to be prefixed to be safe.

[ben-eb]

What do you think about an off-by-default flag for this behaviour? In my case, the input is not coming from the end-user; I'm building a site using https://github.com/MoOx/phenomic and so I can trust myself to not clobber the DOM. 😄

[BarryThePenguin]

This would help when working with https://github.com/wooorm/remark-toc too

[wooorm]

id attributes are allowed according to the current schema, but as they can “clobber” the DOM, they’re prefixed by default. In the schema, remove id from the schema.clobber array!