Elgato_dark/angular
1
0
Fork 0
mirror of https://github.com/angular/angular synced 2026-05-24 09:28:37 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Merge 4321c21a53 into 06b004ec5c

Browse source
This commit is contained in:
Artur 2026-05-23 20:18:20 +00:00 committed by GitHub
commit 2fa6a002f6
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 13 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

16
packages/zone.js/lib/zone-impl.ts
View file

@ -762,10 +762,20 @@ export type AmbientZone = Zone;
const global = globalThis as any;
// __Zone_symbol_prefix global can be used to override the default zone
// symbol prefix with a custom one if needed.
// __Zone_symbol_prefix global can be used to override the default zone symbol
// prefix with a custom one if needed. The value must be a non-empty string
// containing only alphanumeric characters and underscores. Any other value
// (including DOM-clobbered objects, empty strings, or strings with special
// characters) is silently ignored and the default prefix is used instead.
// This guards against DOM clobbering attacks where an attacker sets
// __Zone_symbol_prefix to an HTMLElement via e.g. <input name="__Zone_symbol_prefix">,
// which would otherwise corrupt all internal zone symbol key lookups.
export function __symbol__(name: string) {
const symbolPrefix = global['__Zone_symbol_prefix'] || '__zone_symbol__';
const rawPrefix = global['__Zone_symbol_prefix'];
const symbolPrefix =
typeof rawPrefix === 'string' && /^[a-zA-Z0-9_]+$/.test(rawPrefix)
? rawPrefix
: '__zone_symbol__';
return symbolPrefix + name;
}