Web Security · Middle · Question 5 of 75

Where does Vue's `v-html` stand in terms of XSS?

1It runs only on the server, so XSS isn't possible
✓Correct answer: It renders raw HTML, so like dangerouslySetInnerHTML it must only receive sanitized content
3It escapes HTML automatically, so it's always safe

Explanation

Mustache {{ }} bindings escape text. v-html bypasses that on purpose and is the usual source of XSS in Vue apps.

Further reading

Test yourself

Take the Web Security · Middle quiz: questions and options are shuffled, and you get a review of your mistakes at the end.