Symbol Tagging for dangerouslySetInnerHTML to Help Prevent XSS

If you're spreading props from a user provided source we have a XSS. E.g. ```js var data = JSON.parse(decodeURI(location.search.substr(1))); function Foo(props) { return <div><div {...props} /><span>{props.content}</span></div>; } ReactDOM.render(<Foo {...data} />, container); ``` That's already true today because this URL is now an XSS hole: ``` ?{"content":"Hello","dangerouslySetInnerHTML":{"__html":"<a%20onclick=\"alert(%27p0wned%27)\">Click%20me</a>"}} ``` This is very uncommon. There are many different ways to screw up getting user data. However doing that + also spreading is unusual. We decided in #3473 that React should add an extra layer of protection for these types of mistakes. This one is __much__ more uncommon than the one in #3473 though. You should already have a pretty centralized way of sanitizing these objects so it seems to me that adding a Symbol to this object shouldn't be that big of a deal though. Either: ```js { $$typeof:Symbol.for('react.rawhtml'), __html: myHTML } ``` or: ```js { [Symbol.for('react.rawhtml')]: myHTML } ```