theluyuan/vue3-yuanma
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

refactor(security): mark potential unsafe code paths

Browse Source
This commit is contained in:
Evan You 2020-02-12 15:00:32 -05:00
parent 8b7c162125
commit 8e19424c04
3 changed files with 12 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
packages/runtime-dom/src/modules/props.ts
View File

@ -1,3 +1,7 @@
// __UNSAFE__
// Reason: potentially setting innerHTML.
// This can come from explicit usage of v-html or innerHTML as a prop in render
// functions. The user is reponsible for using them with only trusted content.
export function patchDOMProp( export function patchDOMProp(
el: any, el: any,
key: string, key: string,

4
packages/runtime-dom/src/nodeOps.ts
View File

@ -51,6 +51,10 @@ export const nodeOps: Omit<RendererOptions<Node, Element>, 'patchProp'> = {
return el.cloneNode(true) return el.cloneNode(true)
}, },
// __UNSAFE__
// Reason: innerHTML.
// Static content here can only come from compiled templates.
// As long as the user only uses trusted templates, this is safe.
insertStaticContent(content, parent, anchor, isSVG) { insertStaticContent(content, parent, anchor, isSVG) {
const temp = isSVG const temp = isSVG
? tempSVGContainer || ? tempSVGContainer ||

4
packages/vue/src/index.ts
View File

@ -31,6 +31,10 @@ function compileToFunction(
if (__DEV__ && !el) { if (__DEV__ && !el) {
warn(`Template element not found or is empty: ${template}`) warn(`Template element not found or is empty: ${template}`)
} }
// __UNSAFE__
// Reason: potential execution of JS expressions in in-DOM template.
// The user must make sure the in-DOM template is trusted. If it's rendered
// by the server, the template should not contain any user data.
template = el ? el.innerHTML : `` template = el ? el.innerHTML : ``
} }