somewhat disturbing news about possible XSS in Vue

[qyloxe]

it needs server side rendering and using Vue templates - BUT - it’s perfectly possible in Quasar framework, too:

https://github.com/dotboris/vuejs-serverside-template-xss

spoiler:

this is quite funny by itself:

{{ constructor.constructor(“alert(‘xss’)”)() }}

[rstoenescu]

Hi, probably, but this is due to Vue