From c3f40a5c05a53253b2924765b02b83f6a819948f Mon Sep 17 00:00:00 2001 From: sysy <106249136+AAtomical@users.noreply.github.com> Date: Tue, 4 Aug 2026 23:21:14 -0400 Subject: [PATCH] Use v-dompurify-html in SQText to prevent XSS (#1309) The SQText dashboard component rendered TinyMCE output with v-html, bypassing the DOMPurify sanitization used by every other component. Replace with v-dompurify-html (already registered globally in main.ts). --- frontend/src/views/dashboard/components/sq-text/index.vue | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/frontend/src/views/dashboard/components/sq-text/index.vue b/frontend/src/views/dashboard/components/sq-text/index.vue index e900063e..ad091c46 100644 --- a/frontend/src/views/dashboard/components/sq-text/index.vue +++ b/frontend/src/views/dashboard/components/sq-text/index.vue @@ -16,7 +16,7 @@ @keyup.stop @mousedown.stop @dblclick.stop="setEdit" - v-html="configItem.propValue" + v-dompurify-html="configItem.propValue" >