mirror of
https://github.com/angular/angular
synced 2026-05-24 09:28:37 +00:00
7c42e2ebeb
This commit implements a security fix to prevent XSS vulnerabilities where SVG animation elements (`<animate>`, `<set>`, etc.) could be used to modify the `href` or `xlink:href` attributes of other elements to `javascript:` URLs. The fix introduces a runtime validation step: - A new [ɵɵValidateAttribute](cci:1://file:///usr/local/google/home/alanagius/git/angular/packages/core/src/sanitization/sanitization.ts:276:0-288:1) instruction is used when `attributeName` is bound on SVG animation elements. - If executed, a `RuntimeError` is thrown, preventing the binding. - The compiler now identifies `attributeName` on SVG animation elements as security-sensitive and injects this validation. Additionally, the DOM security schema has been updated to include a comprehensive list of MathML and SVG elements that accept `href` or `xlink:href` attributes, ensuring they are correctly treated as `SecurityContext.URL` and sanitized. This prevents malicious URLs from being bound to these attributes. http://b/463880509 |
||
|---|---|---|
| .. | ||
| expression_parser | ||
| i18n | ||
| ml_parser | ||
| output | ||
| render3 | ||
| schema | ||
| selector | ||
| shadow_css | ||
| BUILD.bazel | ||
| compiler_facade_interface_spec.ts | ||
| integration_spec.ts | ||
| style_url_resolver_spec.ts | ||
| util_spec.ts | ||