Vue · Senior · Question 29 of 75
Why is binding user-controlled values to :style risky?
- ✓Correct answer: Malicious CSS can overlay fake UI (clickjacking) or exfiltrate data via
url(); allow only safe properties - 2Style bindings can execute JavaScript directly
- 3It is never risky
Explanation
Prefer binding only specific properties (e.g. color) from user input, validated against an allow-list, and never a whole user-provided style object.