search

view-design / ViewUI

A high quality UI Toolkit built on Vue.js 2.0
https://www.iviewui.com/
Other
2.65k stars 797 forks source link

[Bug Report]Notice等组件存在XSS攻击风险 #1001

Open mazhewei opened 3 years ago

mazhewei commented 3 years ago

Environment

Windows10 / Chrome 90 / Vue 2.6

Reproduction link

https://run.iviewui.com/AowHNl9i

Steps to reproduce

见链接

What is expected?

使用v-text或textContent来显示目标文本

What is actually happening?

直接将结果放到了dom中，导致文本被当作源码执行