官术网_书友最值得收藏!

Text interpolation escaping

Let's try to display our note in a new pane using a text interpolation:

  1. Create an <aside> element with the preview class, which displays our notePreview computed property:
      <!-- Preview pane -->
      <aside class="preview">
        {{ notePreview }}
      </aside>

We should now have the preview pane displaying our note on the right side of the app. If you type some text in the note editor, you should see the preview updating automatically. However, there is an issue with our app, which arises when you use markdown formatting.

  1. Try making your text bold by surrounding it with **, as follows:
      I'm in **bold**!

Our computed property should return this in valid HTML, and we should have some bold text rendered in our preview pane. Instead, we can see the following:

I'm in <strong>bold</strong>!

We have just discovered that the text interpolation automatically escapes the HTML tags. This is to prevent injection attacks and improve the security of our app. Fortunately, there is a way to display some HTML, as we will see in a moment. However, this forces you to think about using it to include potentially harmful dynamic content.

For example, you create a comment system, where any user can write some text to comment on your app pages. What if someone writes some HTML in their comment, which is then displayed in the page as valid HTML? They could add some malicious JavaScript code, and all the visitors of your app would be vulnerable. It's called a cross-site scripting attack, or an XSS attack. That's why text interpolation always escapes HTML tags.

It is not recommended to use v-html on content created by the users of the application. They could write malicious JavaScript code inside a <script> tag that would be executed. However, with normal text interpolation, you would be safe because the HTML would not be executed.

主站蜘蛛池模板: 宁阳县| 夏津县| 南城县| 湄潭县| 平遥县| 临漳县| 中西区| 绵竹市| 吉安市| 新宾| 诸城市| 元江| 鹿邑县| 清苑县| 紫金县| 台东市| 萝北县| 马尔康县| 永新县| 东乌珠穆沁旗| 博乐市| 洛宁县| 泰和县| 通城县| 大英县| 丹凤县| 宜君县| 黄骅市| 宁国市| 乐平市| 大名县| 涪陵区| 黑水县| 织金县| 齐河县| 林芝县| 武冈市| 阜新市| 邛崃市| 辽阳县| 普格县|