8569db8875
Some checks failed
DevInfra / assistant_to_the_branch_manager (push) Has been cancelled
CI (push) / lint (push) Has been cancelled
CI (push) / devtools (push) Has been cancelled
CI (push) / test (push) Has been cancelled
CI (push) / integration-tests (push) Has been cancelled
CI (push) / adev (push) Has been cancelled
CI (push) / publish-snapshots (push) Has been cancelled
CI (push) / zone-js (push) Has been cancelled
Update ADEV Angular CDK APIs and CLI Help / Update Angular CDK APIs and CLI Help (if necessary) (push) Has been cancelled
CI (push) / adev-deploy (push) Has been cancelled
In server-side rendering (SSR) setups, passing request URLs directly to the lower-level rendering APIs `renderModule` or `renderApplication` can expose applications to Server-Side Request Forgery (SSRF) or Host Header Injection attacks via absolute-form request URLs. To mitigate these vulnerabilities at the framework layer, this commit introduces the `allowedHosts` option to `PlatformConfig` (supporting exact hostnames, wildcards like `*.example.com`, or `*` to allow all). During platform initialization inside `createServerPlatform`, the hostname of the request `url` is validated against the `allowedHosts` list. If the hostname is not authorized, bootstrap immediately throws a host validation error, preventing unauthorized rendering and silent SSRF bypasses. Closes #68436 |
||
|---|---|---|
| .. | ||
| e2e | ||
| projects | ||
| .editorconfig | ||
| .gitignore | ||
| angular.json | ||
| BUILD.bazel | ||
| package.json | ||
| README.md | ||
| tsconfig.json | ||
| yarn.lock | ||
PlatformServer
This project was generated with Angular CLI version 16.0.0-rc.0.
Development server
Run ng serve for a dev server. Navigate to http://localhost:4200/. The application will automatically reload if you change any of the source files.
Code scaffolding
Run ng generate component component-name to generate a new component. You can also use ng generate directive|pipe|service|class|guard|interface|enum|module.
Build
Run ng build to build the project. The build artifacts will be stored in the dist/ directory.
Running unit tests
Run ng test to execute the unit tests via Karma.
Running end-to-end tests
Run ng e2e to execute the end-to-end tests via a platform of your choice. To use this command, you need to first add a package that implements end-to-end testing capabilities.
Further help
To get more help on the Angular CLI use ng help or go check out the Angular CLI Overview and Command Reference page.