olado/doT

How to avoid xss attack?

PEIYANGXINQU opened this issue · 3 comments

PEIYANGXINQU commented

It seems that doT do not check the input content.If the content is alert(999)</script>,then it will execute and alert the window. How to avoid this situation?

leoyli commented

doT is not a sanitizer but a compiler, so that is not its job. In your case, you have to use 3rd-party lib on top of it.

  • 👍1
PEIYANGXINQU commented

@leoyli ,Hi,Do you know that the other template js called Mustache have the xss protect or not?

epoberezkin commented

@PEIYANGXINQU that's unlikely, as it's out of scope, although this question should be asked there.