My project has admin panel and main page. On admin panel I can create posts using HTML editor (VueEditor in this example) post that in data base looks like this:
<p>Here is some test text from VueEditor</p>
Then, I want to parse it one the main page, but, of course, without <p> tag, so I use this:
<p v-html='item.plot'></p>
And here is a problem, IDE tells:
ESLint: 'v-html' directive can lead to XSS attack.(vue/no-v-html)
Is this really that dangerous? Should I parse it some other way?
Yes it is really that dangerous.
Consider what happens when I create the post.
Hi I'm Dave this is my <script>alert('pwned,' + document.cookie)</script> post!
I can now run arbitrary JS code on your website and steal login info for every user you serve this code too.
I'm not super familiar with vue in particular but most frameworks have an easy way to output sanitized html. I think this is {{ itme.plot }} in vue. This will not render an actual (or any other tag) but an escaped version <script> which the browser will not interpret as actual code.
There are a million other way to do XSS if you let me inject my own HTML in your website.