3 ms·
No, it's "server-side does proper sanitization for server-side rendering" and "client does proper sanitization for client-side rendering", but when both are com
by pornel 9y ago
No, it's "server-side does proper sanitization for server-side rendering" and "client does proper sanitization for client-side rendering", but when both are combined, they allow XSS, because server-side-rendered page is re-interpreted as a client-side template.
The flaw is not immediately obvious, because each renderer is safe in isolation.
- zaarn 9y agoI would interpret that as a server-side render being improperly sanitized since obviously data from the server is being wrongfully executed. So that means either the server has to properly escape data or take additional steps to isolate data and code.
- rk06 9y agoI don't agree with it. Server knows that it is passing data for Vue templates, not html. So, it can't be considered safe in isolation. PS: I see that the article is informative. as I was not aware of such exploits. However, the headline is too clickbait-y.