Don't make secure code hard

[kolaente]

I've just been notified of a possible xss attack in my application which was related to the way I was using v-tooltip to show some information based on user input. As it turns out, there's an option to prevent v-tooltip from rendering passed content as html, but it just renders all content as html by default you throw at it.

IMHO, this is bad. It should not take me more work to write secure code than insecure code if it is possible to do this (and v-tooltip is in a good position to prevent me from that). All template engines and web frameworks (not only vue js) make you go and extra mile if you want to render html from a variable. Not so much v-tooltip which just assumes html all the time. I know there is documentation, but I also know from my own projects you can't expect users to read through all of your documentation. Most users just scan the readme to know if the thing does what they want and then use it. This is also bad considering the "default" for users of vue js is not to assume that stuff passed as an attribute to a component renders as html.

</rant>

Going forward, I propose one of the two following changes and would be happy to send PRs for them, if this is generally desired:

1. Put a big red warning in the docs telling the users their tooltip gets rendered as html by default and how to change that.
2. Disable rendering v-tooltip strings as html by default. I know this is a breaking change therefore option 1 may be better suited for now. At least for a possible next version (maybe with vue 3?) this should be seriously considered.

[Akryum]

In the next version, the tooltips doesn't render HTML by default: https://github.com/Akryum/v-tooltip/blob/v3.0/src/config.js#L33

[kolaente]

Awesome! Do you have an eta when this will be released?