Computed properties sanitization in VueJS

1
votes

It's safe to append an URL in Vue using a computed property if the link is provided by an external API service?

For example:

<img :src="imgURL">

VueJS

computed: {
 imgURL(){
  return `https://exampleur.com${poster.4by4}`
 }
}
1
javascriptvue.js
What do you mean by safe? What are your intentions with this link? - vchan
@vchan for safe I mean that is safe to use inside the template. The link will only load the image, nothing more. Mozilla addons want that the DOM is sanitized but in the case of vue I don't think that this is possible for the dom and for a bindend link - nukiko12
Does the image come from your web application? If yes, is it just a content image? I mean is there anything legal about displaying this image or another? If you understand my concerns, you can also understand that a simple question can raise a lot more complex questions. However, the safe choice I believe it would be to decide on the server side regarding which content in general you would want to illustrate on your front-end. - vchan
The image is provided by an API and can be displayed without any legal problem or issue, the problem here is that who reviewed the adons still insist that the DOM needs to be sanitized, that's impossible because the <img> tag is part of the template and the only information added is the src attribute that is a computed property. Anyway I think that who reviewed the addon don't know how vuejs works under the hood. - nukiko12
If you're afraid that it's not safe, i.e. will be prone to script injection and etc., you shouldn't be. - Terry

1 Answers

1
votes

I am here to confirm that you can use computed property as image source and it is safe