Dynamische Bereinigung von Direktiven-Argumenten gegen Prototype Pollution

import { sanitizeHtmlKey } from './security-utils';
 
export const vSecureAttr = {
  mounted(el, binding) {
    const rawKey = String(binding.arg || '');
    if (Object.prototype.hasOwnProperty.call(Object.prototype, rawKey)) {
      throw new SecurityError('Potential prototype pollution in directive argument.');
    }
    const safeKey = sanitizeHtmlKey(rawKey);
    el.setAttribute(`data-${safeKey}`, String(binding.value));
  },
  updated(el, binding) {
    if (binding.value !== binding.oldValue) {
      const safeKey = sanitizeHtmlKey(String(binding.arg || ''));
      el.setAttribute(`data-${safeKey}`, String(binding.value));
    }
  }
};