Skip to content

no-v-html.md

Latest commit

 

History

History
78 lines (53 loc) · 1.91 KB

no-v-html.md

File metadata and controls

78 lines (53 loc) · 1.91 KB
pageClass rule-details
sidebarDepth 0
title vue/no-v-html
description disallow use of v-html to prevent XSS attack
since v4.7.0

vue/no-v-html

disallow use of v-html to prevent XSS attack

  • ⚙️ This rule is included in all of "plugin:vue/recommended", *.configs["flat/recommended"], "plugin:vue/vue2-recommended" and *.configs["flat/vue2-recommended"].

📖 Rule Details

This rule reports all uses of v-html directive in order to reduce the risk of injecting potentially unsafe / unescaped html into the browser leading to Cross-Site Scripting (XSS) attacks.

<template>
  <!-- ✓ GOOD -->
  <div>{{ someHTML }}</div>

  <!-- ✗ BAD -->
  <div v-html="someHTML"></div>
</template>

🔧 Options

{
    "vue/no-v-html": ["error", {
        "ignorePattern": ".Html$"
    }]
}
  • ignorePattern ... disables reporting when the v-html directive references a variable matching this pattern. By default, all v-html uses are forbidden.

{ "ignorePattern": ".Html$" }

<template>
  <!-- ✓ GOOD -->
  <h2>{{ userName }}</h2>
  <span v-html="userLinkHtml" />

  <!-- ✗ BAD -->
  <span v-html="userName" />
</template>

🔇 When Not To Use It

If you are certain the content passed to v-html is sanitized HTML you can disable this rule.

👫 Related Rules

🚀 Version

This rule was introduced in eslint-plugin-vue v4.7.0

🔍 Implementation