Alan Agius a451a1d66e fix(platform-server): add allowedHosts option to renderModule and renderApplication ... In server-side rendering (SSR) setups, passing request URLs directly to the lower-level rendering APIs `renderModule` or `renderApplication` can expose applications to Server-Side Request Forgery (SSRF) or Host Header Injection attacks via absolute-form request URLs. To mitigate these vulnerabilities at the framework layer, this commit introduces the `allowedHosts` option to `PlatformConfig` (supporting exact hostnames, wildcards like `*.example.com`, or `*` to allow all). During platform initialization inside `createServerPlatform`, the hostname of the request `url` is validated against the `allowedHosts` list. If the hostname is not authorized, bootstrap immediately throws a host validation error, preventing unauthorized rendering and silent SSRF bypasses. Closes #68436 (cherry picked from commit 60552a73e8)		2026-05-07 15:30:08 -07:00
..
src	ci: reformat files	2025-12-16 14:44:19 -08:00
prerender.ts	fix(core): properly handle app stabilization with defer blocks (#61040)	2025-04-30 12:37:02 -07:00
server.ts	fix(platform-server): add allowedHosts option to renderModule and renderApplication	2026-05-07 15:30:08 -07:00
tsconfig.app.json	build: remove yarn from integration tests, switch to pnpm (#63902)	2025-09-18 14:39:51 +00:00
tsconfig.spec.json	test: add integration test for platform-server with zoneless (#61040)	2025-04-30 12:37:01 -07:00