工程化解决前端xss攻击

npm isntall xss

编译前 通过vue-loader传入的compilerOptions.directives 与 baseOptions.directives 合并

chainWebpack: config => {
  config.module
    .rule("vue")
    .use("vue-loader")
    .loader("vue-loader")
    .tap(options => {
      options.compilerOptions.directives = {
        html(node, directiveMeta) {
          (node.props || (node.props = [])).push({
            name: "innerHTML",
            value: `xss(_s(${directiveMeta.value}))`
          });
        }
      };
    return options;
  });
}

来源：vue项目 v-html存在植入xss攻击怎么解决