Skip to content
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.

Commit 3bf3f42

Browse files
authoredApr 5, 2025··
Update security.md
Change sanitize-url suggested package
1 parent b70003e commit 3bf3f42

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed
 

Diff for: ‎src/guide/best-practices/security.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -110,7 +110,7 @@ In a URL like this:
110110
</a>
111111
```
112112

113-
There's a potential security issue if the URL has not been "sanitized" to prevent JavaScript execution using `javascript:`. There are libraries such as [sanitize-url](https://www.npmjs.com/package/@braintree/sanitize-url) to help with this, but note: if you're ever doing URL sanitization on the frontend, you already have a security issue. **User-provided URLs should always be sanitized by your backend before even being saved to a database.** Then the problem is avoided for _every_ client connecting to your API, including native mobile apps. Also note that even with sanitized URLs, Vue cannot help you guarantee that they lead to safe destinations.
113+
There's a potential security issue if the URL has not been "sanitized" to prevent JavaScript execution using `javascript:`. There are libraries such as [sanitize-url](https://www.npmjs.com/package/@sofuxro/sanitize-url) to help with this, but note: if you're ever doing URL sanitization on the frontend, you already have a security issue. **User-provided URLs should always be sanitized by your backend before even being saved to a database.** Then the problem is avoided for _every_ client connecting to your API, including native mobile apps. Also note that even with sanitized URLs, Vue cannot help you guarantee that they lead to safe destinations.
114114

115115
### Style Injection {#style-injection}
116116

0 commit comments

Comments
 (0)
Please sign in to comment.