useHead script children vulnerable to XSS

[belomx]

Environment
https://codesandbox.io/s/new-haze-rmtleo?file=/app.vue

Reproduction
Open the page and the alert will pop-up.

Describe the bug
The useHead can be used for XSS Attack.
In my application, the user's inputs are part of the 'application/ld+json' script for SEO purposes. And a users can insert a malicious script.

Additional context
Good to notice, the xss attack will work only if the script passed as a prop to a component.

[Skmt3P]

+1

[harlan-zw]

To give context, you are providing a string to the children of script, which accepts raw scripts.

The primary use case for doing this, is to insert application scripts within the head, so raw scripts are allowed by default.

There are many ways you can solve this on your end:

• use @vueuse/schema-org
• build the schema object as an object then create the string using JSON.stringify
• provide the children as an object (it will be encoded for you automatically)
• just sanitise the user input when you make the string

There isn't too much this package can do to avoid you from introducing XSS vulnerabilities into your app if you really want.

I will consider the following though:

• if the script type is application/json we can sanitise the input to be JSON
• introduce useHeadSafe to provide a bulletproof way to avoid XSS

Both of these don't fix the "XSS", it's on the dev not to do silly things with user input

[Skmt3P]

Since @harlan-zw gave us this idea, I'm sure this issue is no longer a problem, but I'll share this issue's reproduction now,
https://stackblitz.com/edit/nuxt-starter-nynkwv?file=app.vue

I'm looking forward to useHeadSafe() coming to Nuxt3 👍

[harlan-zw]

Hey, there are many XSS improvements to address this issue available since 1.1.0.

• useHeadSafe
• children is deprecated in favor of innerHTML and textContent, the XSS issues should be more obvious with this. See https://unhead.harlanzw.com/guide/guides/inner-content
• Any application/json or application/ld+json will now be validated as proper JSON (fixes any XSS)

If you have any other ideas on how to improve XSS issues then please create a new issue! Happy to explore making the package as safe as possible without hindering DX.