None of this is caused because of them using a dynamic language. It's caused because the developers used a function literally called "dangerouslySetInnerHTML" that doesn't escape HTML. That's it. It's just lazy programming.
The app isn't using React but jQuery, which doesn't have those protections.
https://github.com/signalapp/Signal-Desktop/blob/f6eb745632c...
They do seem to be using react, and using dangerouslySetInnerHTML. Now that said, I haven't confirmed that this is the code that caused the issue, but it is in the Quotes component, which is referenced in the article.
They seem to have fixed this specific issue a few days ago (v.11.0):
https://github.com/signalapp/Signal-Desktop/blob/0d00fbfb7a2...
They do seem to be using jQuery elsewhere in the code base, but I'm not familiar enough to determine how it all fits together.
The Android app was written by Moxie, and I think it's the one about which Matthew Green said:
After reading the code, I literally discovered a line of drool running down my face. It’s really nice.
struct A {
int *p = nullptr;
A& operator=(int i) {
*p = i;
return *this;
}
};
int main(void)
{
A a;
a = 1; /* boom! */
return 0;
}