disallow use of v-html to prevent XSS attack

  • ⚙️ This rule is included in "plugin:vue/recommended".

📖 Rule Details

This rule reports all uses of v-html directive in order to reduce the risk of injecting potentially unsafe / unescaped html into the browser leading to Cross-Site Scripting (XSS) attacks.

<template> <!-- ✓ GOOD --> <div>{{ someHTML }}</div> <!-- ✗ BAD --> <div v-html="someHTML"></div> </template>
Now loading...

🔧 Options


🔇 When Not To Use It

If you are certain the content passed to v-html is sanitized HTML you can disable this rule.

📚 Further reading

🔍 Implementation

Last Updated: 12/30/2018, 3:44:02 AM