toVDom function on programmatic components is duplicating content on html tags

[eagleera]

Overview of the problem

Buefy version: [0.9.1]
Vuejs version: [2.6.11]
OS/Browser: Catalina / Chrome

Description

When using an html template inside the message prop on NotificationProgrammatic, the html doesn't render well, the classes are ignored and some tags are duplicated (I think it has to do with the toVDom function

Steps to reproduce

create a notification programmatic
in the message put <div class="has-text-success">Something's</div> not good, also I'm on <b>bottom</b>
You should see the "Something's" rendered twice

Expected behavior

Instead of "Something's" being rendered twice, we should see "Something's" on a success color

Actual behavior

the "Something's" is being rendered twice

[jtommy]

The main idea is to support simple message, but I'll try to fix it

[simeq]

Can this issue be related to https://codepen.io/simeq/pen/gOrwwPE (example from documentation) and this https://codepen.io/simeq/pen/yLOaaJJ?

[jtommy]

@simeq wrong docs, I'll fix it

[Tofandel]

@jtommy The toVDom function is originally not a good idea as it doesn't fix XSS at all, so many things could go wrong when you let a user display HTML (sure with a bit of validation but HTML nontheless, you could put an onload handler in there and execute JS or just display a full on body modal) don't give a false illusion of security and make two props available as suggested
'message' => All html is allowed, 'messageText' => All html is escaped

[jtommy]

Probably it's not a good parse but I don't think it's xss vulnerable because I attach only tag and text content

[Tofandel]

I don't really have the time, but I could easily make an attack demonstration if you want, since all tags are allowed you could make use of web components declared on the page (it's quite common with vue) they are not safe to be displayed as they will execute javascript when added to a page and you could for instance create a phishing modal given the right circumstances or just make the page crash with an unanticipated js error

Removing all attributes (eg: classes, href, form attributes) also entirely defeats the point of allowing html in the message content you might as well just allow text, because in a programmatic modal for example it now becomes impossible to display a simple form or to style the displayed message