[docs-infra] Remove dangerouslySetInnerHTML for ad description

[Janpot]

Avoid injecting unsanitized html from third party ad networks.

Credit goes to @Gyde04, thank you for reporting!

Preview https://deploy-preview-46936--material-ui.netlify.app/material-ui/react-button/

[mui-bot]

Netlify deploy preview

https://deploy-preview-46936--material-ui.netlify.app/

Bundle size report

Bundle	Parsed size	Gzip size
@mui/material	0B(0.00%)	0B(0.00%)
@mui/lab	0B(0.00%)	0B(0.00%)
@mui/system	0B(0.00%)	0B(0.00%)
@mui/utils	0B(0.00%)	0B(0.00%)

Details of bundle changes

Generated by 🚫 dangerJS against 1c72895

[oliviertassinari]

I don't expect regressions from those changes; it seems OK.

On the security part, this seems far-fetched, we grant all permissions to https://cdn.carbonads.com/carbon.js by loading this as a script, which uses .innerHTML to inject the description, so they already have to sanitize the ad description, so this should make no difference.

However, forcing strings enforces consistency in the ad layout, which seems like a positive UI change.

[Janpot]

On the security part, this seems far-fetched, we grant all permissions to https://cdn.carbonads.com/carbon.js by loading this as a script, which uses .innerHTML to inject the description, so they already have to sanitize the ad description, so this should make no difference.

We're loading these ads from https://srv.buysellads.com/. I think this makes some difference, we halved the amount of ad domains that can inject code in our pages.

material-ui/packages/mui-docs/src/Ad/AdCarbon.tsx

Line 86 in 4a24067

response = await fetch('https://srv.buysellads.com/ads/CE7DC23W.json');

[oliviertassinari]

We're loading these ads from https://srv.buysellads.com/

For context, srv.buysellads.com and cdn.carbonads.com are operated by the same product.