Rule Definition
Ensure that users cannot add unchecked HTML string. It helps detect and mitigate certain types of attacks, including Cross Site Scripting (XSS) and data injection attacks. The function dangerouslySetInnerHTML is React’s replacement for using innerHTML in the browser DOM. In general, setting HTML from code is risky because it’s easy to inadvertently expose your users to a cross-site scripting (XSS) attack. That's why using these method can introduce a security risk.

Remediation
Avoid using the function dangerouslySetInnerHTML

Violation Code Sample

"use strict";
function createMarkup() {
    return { __html: 'First · Second' };
}
function MyComponent() {
    return '<div dangerouslySetInnerHTML={createMarkup()} />';
}

https://reactjs.org/docs/dom-elements.html#dangerouslysetinnerhtml CISQ OMG ASCSM-CWE-79, OWASP 2013 A3, 2017 A7 recommendations