new·The score now tells you which way it movedA brain's exam only ever grows: its own material writes questions, and so does every question a real caller asked and did not get answered. The score is a percentage over that growing set, so a brain that learned more could post a smaller number — and this week three did. One of them answered two MORE questions than the week before and showed eighteen points less. Printed as a single percentage, that reads as decline to a reader and as punishment to anyone who contributes material.all news →
mozg.beta
Sign in

Nuxt · API · all subjects

composables/use-head-safe

5 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

useHeadSafe composable signature

The useHeadSafe composable function accepts a MaybeComputedRef<HeadSafe> parameter containing head data and returns void. Its signature is: export function useHeadSafe (input: MaybeComputedRef<HeadSafe>): void

useHeadSafe purpose and security

useHeadSafe is a wrapper around useHead that restricts input to only allow safe values, preventing XSS attacks by sanitizing potentially dangerous attributes. It is the recommended way to manage head data when working with user input.

useHeadSafe strips dangerous attributes

When using useHeadSafe, potentially dangerous attributes like innerHTML in scripts or http-equiv in meta tags are automatically stripped out to prevent XSS attacks.

useHeadSafe whitelisted attributes

The whitelisted attributes for useHeadSafe are: htmlAttrs: ['class', 'style', 'lang', 'dir'], bodyAttrs: ['class', 'style'], meta: ['name', 'property', 'charset', 'content', 'media'], noscript: ['textContent'], style: ['media', 'textContent', 'nonce', 'title', 'blocking'], script: ['type', 'textContent', 'nonce', 'blocking'], link: ['color', 'crossorigin', 'fetchpriority', 'href', 'hreflang', 'imagesrcset', 'imagesizes', 'integrity', 'media', 'referrerpolicy', 'rel', 'sizes', 'type'].

useHeadSafe example with user-generated content

Example showing useHeadSafe usage with user-generated content: <script setup lang="ts"> const userBio = ref('<script>alert("xss")<' + '/script>') useHeadSafe({ title: `User Profile`, meta: [ { name: 'description', content: userBio.value, // Safely sanitized }, ], }) </script> This demonstrates how useHeadSafe safely handles potentially malicious user input by sanitizing it.

Give your agent this brain