From 76abfd9cf7d13c9d315d5d993b0ac648742c6eec Mon Sep 17 00:00:00 2001 From: sysy <2772196789@qq.com> Date: Mon, 3 Aug 2026 15:15:37 -0400 Subject: [PATCH] Use v-dompurify-html in SQText to prevent XSS The SQText dashboard component rendered TinyMCE output with v-html, bypassing the DOMPurify sanitization used by every other component. Replace with v-dompurify-html (already registered globally in main.ts). --- frontend/src/views/dashboard/components/sq-text/index.vue | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/frontend/src/views/dashboard/components/sq-text/index.vue b/frontend/src/views/dashboard/components/sq-text/index.vue index e900063ed..ad091c465 100644 --- a/frontend/src/views/dashboard/components/sq-text/index.vue +++ b/frontend/src/views/dashboard/components/sq-text/index.vue @@ -16,7 +16,7 @@ @keyup.stop @mousedown.stop @dblclick.stop="setEdit" - v-html="configItem.propValue" + v-dompurify-html="configItem.propValue" >