mustache-security review of VueJS

[alexanderkjeldaas]

FYI,

https://code.google.com/p/mustache-security/wiki/VueJS

I guess those issues should have an issue in the bug tracker, so this is it. Maybe some code from Angular could be reused in Vue?

[yyx990803]

The thing about template expressions is that they only form an attack vector when untrusted content are rendered server-side and then compiled by Vue. This is obviously not recommended. You will definitely run into security problems if you render untrusted html on server-side, regardless of what framework you are using. and Simply put, the best practice is never let Vue compile anything you can't trust. Vue's documentation also warns explicitly against the use of v-html for untrusted content.

Angular has much more resource to work specifically on security related issues, which is a luxury other smaller open source projects cannot afford. (Almost all other frameworks reviewed fail most of the criteria).

[alexanderkjeldaas]

Isn't it possible to extract the templating from angular and use it directly? Then Vue benefits from the investments the Angular has done. What are the dependencies (on either side) that makes this untangling hard?

[yyx990803]

Vue doesn't use an AST-based parser, but rather simply does path-rewrite then constructs a function. This is mainly for code size considerations (Vue's parser is ~100 lines without comments while Angular's is ~1000 lines). Thus the techniques used in Angular's parser is not applicable unless Vue uses a different parser implementation.

One difference to note is that Vue has no automatic bootstrapping - you always have to explicitly tell Vue the root elements to compile on a page. If the developer follow the simple rule to compile only part of the DOM that can be trusted, then none of these security measures are necessary. Granted I should emphasize the importance of this in the docs.

In the future I might ship a separate CSP-compliant build using an AST-based parser, which could leverage the work done by Angular.