sample v-html injection

by Pasit R

HTML

<script src="https://cdnjs.cloudflare.com/ajax/libs/moment.js/2.29.1/moment.min.js"></script>
<html>

  <head>
  </head>

  <body>
    <section id="my-app">
      <button v-on:click="tryMe()">try me!</button>
      <p>info: {{ info }}</p>
      <div v-html="message">Message here</div>
    </section>
  </body>

</html>

Vue

const app = new Vue({
  el: "#my-app",
  data: () =>({
    message: 'plese wait...',
    info: 'working on it'
  }),
  mounted() {
		this.message = 'ready!'
    this.info = ''
  },
  methods: {
    tryMe: function() {
      const now = moment().format('MM/DD/YYYY hh:mm:ss')
      this.info = `updated at ${now}`
      this.message = `<dialog open><a href="#" onclick="alert('foo!'); window.location.href='https://jsfiddle.net/'" style="color:black; cursor:default; text-decoration: none">click me</a></dialog>`
    }
  }
})