Bereinigung von unsicherem HTML-Input zur Vermeidung von XSS-Angriffen

import { defineComponent, computed, ref } from 'vue';
import DOMPurify from 'dompurify';
 
export default defineComponent({
  setup() {
    const untrustedUserInput = ref('<img src="x" onerror="alert(1)"><b>Safe User Comment</b>');
 
    const sanitizedHtml = computed(() => {
      return DOMPurify.sanitize(untrustedUserInput.value, {
        ALLOWED_TAGS: ['b', 'i', 'em', 'strong', 'p'],
        ALLOWED_ATTR: []
      });
    });
 
    return { sanitizedHtml };
  },
  template: '<div v-html="sanitizedHtml"></div>'
});