Whenever I include js code like
"><img src=1 onerror=prompt(document.cookie);>The notification appears as shown in this image: https://i.sstatic.net/Gju9h.jpg and a popup shows the cookie information.
When I execute
console.log(response.data.message);Created Site ""><img src=1 onerror=prompt(document.cookie);>" successfully!Vue escapes HTML but toasted does not. Here is the relevant code snippet:
handleFormSubmit: function(response) {
this.showAddSiteModal = false;
if (response.data.status === 'success')
{
console.log(response.data.message);
this.$toasted.success(response.data.message); //<<< problem here
this.addSite(response.data.site);
}
else
{
this.$toasted.error(response.data.message);
}
},