
Security News
Crates.io Implements Trusted Publishing Support
Crates.io adds Trusted Publishing support, enabling secure GitHub Actions-based crate releases without long-lived API tokens.
一个开箱即用的Vue.js插件,可通过简单的方式防止XSS攻击
有任何问题欢迎发布 issue,我会在看到后第一时间回复大家。如果觉得还不错的话,不要吝啬你的 star 哦~
推荐使用npm安装
npm i vue-xss
// main.js
import VueXss from 'vue-xss'
Vue.use(VueXss)
<!-- *.vue -->
<div v-html="$xss(content)"></div>
支持 js-xss 的自定义规则,可通过 options 对象形式传入实例, 具体请点击 js-xss 查看
// mani.js
var options = {
// 默认白名单参考 xss.whiteList
whiteList: {
a: ['href', 'style'],
img: ['src', 'alt'],
...
},
stripIgnoreTag: true, // 去掉不在白名单上的标签 true:去掉不在白名单上的标签
stripIgnoreTagBody: ['script', 'style'] // 去掉不在白名单上的标签及标签体 ['tag1', 'tag2']:仅去掉指定的不在白名单上的标签
onTagAttr: function () {
// todo
},
...
}
import VueXss from 'vue-xss'
Vue.use(VueXss, options)
<!-- *.vue -->
<template>
<div v-html="$xss(content)"></div>
<!-- 过滤后输出:<iframe></iframe> -->
<template>
<script>
export default {
data () {
return{
content: '<iframe onload=alert("XSS-TEST")></iframe>'
}
},
...
}
</script>
感谢 js-xss 作者的支持 @ leizongmin
FAQs
一个开箱即用的Vue.js插件,可通过简单的方式防止XSS攻击
We found that vue-xss demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Crates.io adds Trusted Publishing support, enabling secure GitHub Actions-based crate releases without long-lived API tokens.
Research
/Security News
Undocumented protestware found in 28 npm packages disrupts UI for Russian-language users visiting Russian and Belarusian domains.
Research
/Security News
North Korean threat actors deploy 67 malicious npm packages using the newly discovered XORIndex malware loader.