How does VanJS deal with XSS and mXSS injection?

[Ashvith10]

I don't know much about front-end security, but I came across mXSS recently, and I was wondering how such injection-based attacks are dealt with.

[Tao-VanJS]

In VanJS's implementation, it doesn't treat input strings as HTML strings. I think this makes VanJS not exposed to XSS attacks. To make your app XSS-proof, don't treat arbitrary user input as an HTML string without sanitization.

[Ashvith10]

@Tao-VanJS I should've also asked about mXSS. What do you think of that?

[Tao-VanJS]

VanJS is not using APIs that are vulnerable to XSS or mXSS attacks.