2 years ago

Vue interpolation

Posted 2 years ago by kenny11

When you have a user content which includes double curly brakets {{ }} in blade files, it will compile it by Vue.

So, what I mean by that is if users' input is like this my input is {{ alert('hello xss vulnabilities') }} it will alert in blade files. If you don't trust me try it, but you need to run npm run production since the command remove a debug tool.

public function index () {
$text = 'hello {{ xss vulnabilities }}';

return view('welcome', compact('text'));


// the screen will go blank if your js file is not minified but it will alert when minified
in blade
<h1>{{ $text }}</h1>

Yes we can use v-pre on every tag where you show your users' contents to tell Vue to not compile it but it is very tiring isn't it?

How do you guys go about fixing this?

Please sign in or create an account to participate in this conversation.