Search code examples
vue.jsvuejs2sonarqube

Make sure bypassing Vue built-in sanitization is safe here

<div v-html="this.getNormalMessage()"></div>

We are using "vue": "^2.5.17". While running a sonarqube report we got these hotspots "Make sure bypassing Vue built-in sanitization is safe here." for the above code snippet. Using v-html is causing this hotspot in sonarqube report. getNormalMessage is function which returns htmlContent.

we tried the solutions like

<div>{{ getNormalMessage }}</div>

but these solutions are converting content into a plain text. In our case we needed it to be rendered as html. Do we have better solutions ?

Solution

  • As mentioned here, you can use vue-dompurify-html.
    Be careful, only the v2.5.2 has still Vue2 support, then it's dropped.