Always sanitize unless explicitly told not to

I want Quasar to be secure by default so I’m starting this discussion to get options like display-value-sanitize deprecated in favor of no-display-value-sanitize.

In the security section you read stuff like

If you are not customizing menu-related scoped-slots (i.e. option scoped slot), DO prevent the component from rendering HTML in the labels and sublabels with one or more of the sanitize properties.

and

Many developers have asked that the Loading plugin be able to display HTML, so this was enabled by default, but if you are worried, DO add sanitize: true and you removed the vector.

You can also read that components that are made for displaying user-supplied data like QChatMessage is allowing XSS attacts by default.

This is in my opinion crazy. It will give Quasar a bad reputation because most developers don’t read docs for intuitive frameworks unless they see a problem. Forgetting to sanitize is in most cases an invisible problem but seeing plain text html when you want it to render is not.

[rstoenescu]

@rognstad Done. Quasar 2 (with Vue 3) will sanitize by default unless not told to.

[rognstad]

I’m strongly in favor of a breaking change on this with Quasar v2.

At a minimum, it seems like the QSelect and QChatMessage docs should have a huge red warning at the top of the page that they are insecure by default. (And sorry to necro this 😕)