Template escape using function constructor

Here is the escape

<p>Hello, {{ this.constructor.constructor('alert("oops")')`` }}</p>

Vue.js version

1.0.26

Reproduction Link

http://jsfiddle.net/yvt7eckL/1/

Steps to reproduce

Open the jsfiddle

What is Expected?

No alert boxes

What is actually happening?

Alert box pops up

[bahmutov]

The solution that vue and any other framework should put as a big disclaimer is for users to set strict content security policy and disallow inline scripts.

Sent from my iPhone

On Sep 3, 2016, at 00:39, 宋铄运 [e-mail] wrote:

Hmm… It’s true that one may use template engines + vue and create security loopholes, but I doubt if there’s much to be done at vue’s end (without great efforts), but PRs are always welcome 😄.

In my opinion this should be solved by a framework-agnostic tool or plugin for these template engines, and it should be recommended (or even enforced) for anyone who uses them with vue (or ng or whatever front-end framework).

— You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub, or mute the thread.

[yyx990803]

This has been discussed long ago - the issue here is that the moment you use Vue or any other client side framework to compile a template potentially generated by a malicious 3rd party, you are already busted. There are simply too many ways to get around the system when you need to evaluate arbitrary content - all XSS loopholes apply, and it is simply impractical for the framework to take on that responsibility for the user.

In practice, the simple rule is you should always be able to trust the template you pass to Vue. That’s it.

I do agree we should make this more prominent in the docs though.