Vue · Senior · Question 28 of 75
Is binding a user-provided URL to :href safe in Vue?
- ✓Correct answer: No - Vue doesn't sanitize URLs, so
javascript:URLs must be validated, ideally on the server - 2Yes, Vue strips
javascript:URLs automatically - 3Yes, because attribute bindings are escaped
Explanation
Escaping prevents breaking out of the attribute, not malicious schemes. Validate that the URL starts with https:// or is relative before storing it.