V-Html Raw Rendering (ARCH3325)

Key typescript.vue.v-html · Severity error · Category security

Vue: flags v-html, which renders its value as raw HTML. Anything reaching it from outside the codebase is executed - stored XSS.

Incorrect

<div v-html="comment.body"></div>

Correct

<div>{{ comment.body }}</div>
<!-- or render a sanitised value: v-html="sanitize(comment.body)" -->