<h3 dir="auto">What problem does this feature solve?</h3>
<p dir="auto">通过过滤掉xss攻击代码来解决v-html容易导致的xss攻击</p>
<h3 dir="auto">What does the proposed API look like?</h3>
<p dir="auto">v-html.xss</p>
<h3 dir="auto">What problem does this feature solve?</h3>
<p dir="auto">I'm currently working on making a <a href="https://github.com/krestaino/nuepress">blog</a> using the WordPress REST API as the back end. The API returns the article with HTML markup in it. I'm taking that <a href="https://wp.kmr.io/wp-json/wp/v2/posts/1178" rel="nofollow">JSON response</a> and using <code class="notranslate">v-html</code> to render it into my Vue app. I understand there are cross-site scripting security risks here.</p>
<h3 dir="auto">What does the proposed API look like?</h3>
<p dir="auto">It would be great if <code class="notranslate">v-html</code> automatically sanitized the string to remove any <code class="notranslate">&lt;script&gt;</code> tags. For those needing script tags, for whatever reason, maybe <code class="notranslate">v-html-unsafe</code> can accomplish that.</p>
<p dir="auto">I was recently made aware Angular 4 is doing this and think Vue.js would greatly benefit from this feature.</p>
<p dir="auto"><a href="https://angular.io/guide/security#!#xss" rel="nofollow">https://angular.io/guide/security#!#xss</a></p>