Elgato_dark/angular
1
0
Fork 0
mirror of https://github.com/angular/angular synced 2026-05-24 09:28:37 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions
angular/packages/core/test/acceptance
History
Alan Agius 7c42e2ebeb fix(compiler): prevent XSS via SVG animation attributeName and MathML/SVG URLs 
This commit implements a security fix to prevent XSS vulnerabilities where SVG animation elements (`<animate>`, `<set>`, etc.) could be used to modify the `href` or `xlink:href` attributes of other elements to `javascript:` URLs.

The fix introduces a runtime validation step:
- A new [ɵɵValidateAttribute](cci:1://file:///usr/local/google/home/alanagius/git/angular/packages/core/src/sanitization/sanitization.ts:276:0-288:1) instruction is used when `attributeName` is bound on SVG animation elements.
- If executed, a `RuntimeError` is thrown, preventing the binding.
- The compiler now identifies `attributeName` on SVG animation elements as security-sensitive and injects this validation.

Additionally, the DOM security schema has been updated to include a comprehensive list of MathML and SVG elements that accept `href` or `xlink:href` attributes, ensuring they are correctly treated as `SecurityContext.URL` and sanitized. This prevents malicious URLs from being bound to these attributes.

http://b/463880509
2025-12-01 10:28:38 +01:00
..
authoring build: migrate all ng_module in packages/core/test (#61571) 2025-05-21 16:04:42 +00:00
after_render_effect_spec.ts refactor(core): convert scripts within packages/core/test to relative imports (#60227) (#60556) 2025-03-26 07:05:23 -07:00
after_render_hook_spec.ts build: migrate all ts_library in packages/core/test (#61571) 2025-05-21 16:04:42 +00:00
attach_source_locations_spec.ts refactor(core): convert scripts within packages/core/test to relative imports (#60227) (#60556) 2025-03-26 07:05:23 -07:00
attributes_spec.ts refactor(core): convert scripts within packages/core/test to relative imports (#60227) (#60556) 2025-03-26 07:05:23 -07:00
bootstrap_spec.ts refactor(core): convert scripts within packages/core/test to relative imports (#60227) (#60556) 2025-03-26 07:05:23 -07:00
BUILD.bazel build: migrate all ng_module in packages/core/test (#61571) 2025-05-21 16:04:42 +00:00
change_detection_signals_in_zones_spec.ts refactor(core): convert scripts within packages/core/test to relative imports (#60227) (#60556) 2025-03-26 07:05:23 -07:00
change_detection_spec.ts build: migrate all ts_library in packages/core/test (#61571) 2025-05-21 16:04:42 +00:00
change_detection_transplanted_view_spec.ts build: migrate all ts_library in packages/core/test (#61571) 2025-05-21 16:04:42 +00:00
common_integration_spec.ts refactor(core): convert scripts within packages/core/test to relative imports (#60227) (#60556) 2025-03-26 07:05:23 -07:00
component_spec.ts build: migrate all ts_library in packages/core/test (#61571) 2025-05-21 16:04:42 +00:00
content_spec.ts build: migrate all ts_library in packages/core/test (#61571) 2025-05-21 16:04:42 +00:00
control_flow_for_spec.ts refactor(core): convert scripts within packages/core/test to relative imports (#60227) (#60556) 2025-03-26 07:05:23 -07:00
control_flow_if_spec.ts refactor(core): convert scripts within packages/core/test to relative imports (#60227) (#60556) 2025-03-26 07:05:23 -07:00
control_flow_switch_spec.ts refactor(core): convert scripts within packages/core/test to relative imports (#60227) (#60556) 2025-03-26 07:05:23 -07:00
copy_definition_feature_spec.ts refactor(core): convert scripts within packages/core/test to relative imports (#60227) (#60556) 2025-03-26 07:05:23 -07:00
csp_spec.ts refactor(core): convert scripts within packages/core/test to relative imports (#60227) (#60556) 2025-03-26 07:05:23 -07:00
defer_spec.ts build: migrate all ts_library in packages/core/test (#61571) 2025-05-21 16:04:42 +00:00
defer_utils_spec.ts refactor(core): convert scripts within packages/core/test to relative imports (#60227) (#60556) 2025-03-26 07:05:23 -07:00
destroy_ref_spec.ts fix(core): call DestroyRef on destroy callback if view is destroyed [patch] (#61061) 2025-04-30 08:52:25 -07:00
di_forward_ref_spec.ts refactor(core): convert scripts within packages/core/test to relative imports (#60227) (#60556) 2025-03-26 07:05:23 -07:00
di_spec.ts fix(core): missing useExisting providers throwing for optional calls (#61152) 2025-05-06 14:06:24 -07:00
directive_spec.ts refactor(core): convert scripts within packages/core/test to relative imports (#60227) (#60556) 2025-03-26 07:05:23 -07:00
discover_utils_spec.ts refactor(core): convert scripts within packages/core/test to relative imports (#60227) (#60556) 2025-03-26 07:05:23 -07:00
embedded_views_spec.ts refactor(core): convert scripts within packages/core/test to relative imports (#60227) (#60556) 2025-03-26 07:05:23 -07:00
env_injector_standalone_spec.ts refactor(core): convert scripts within packages/core/test to relative imports (#60227) (#60556) 2025-03-26 07:05:23 -07:00
environment_injector_spec.ts refactor(core): convert scripts within packages/core/test to relative imports (#60227) (#60556) 2025-03-26 07:05:23 -07:00
exports_spec.ts refactor(core): convert scripts within packages/core/test to relative imports (#60227) (#60556) 2025-03-26 07:05:23 -07:00
hmr_spec.ts build: migrate all ts_library in packages/core/test (#61571) 2025-05-21 16:04:42 +00:00
host_binding_spec.ts refactor(core): convert scripts within packages/core/test to relative imports (#60227) (#60556) 2025-03-26 07:05:23 -07:00
host_directives_spec.ts refactor(core): convert scripts within packages/core/test to relative imports (#60227) (#60556) 2025-03-26 07:05:23 -07:00
i18n_spec.ts build: migrate all ts_library in packages/core/test (#61571) 2025-05-21 16:04:42 +00:00
inherit_definition_feature_spec.ts refactor(core): convert scripts within packages/core/test to relative imports (#60227) (#60556) 2025-03-26 07:05:23 -07:00
injector_profiler_spec.ts refactor(core): convert scripts within packages/core/test to relative imports (#60227) (#60556) 2025-03-26 07:05:23 -07:00
integration_spec.ts refactor(core): convert scripts within packages/core/test to relative imports (#60227) (#60556) 2025-03-26 07:05:23 -07:00
internal_spec.ts refactor(core): convert scripts within packages/core/test to relative imports (#60227) (#60556) 2025-03-26 07:05:23 -07:00
let_spec.ts refactor(core): convert scripts within packages/core/test to relative imports (#60227) (#60556) 2025-03-26 07:05:23 -07:00
lifecycle_spec.ts refactor(core): convert scripts within packages/core/test to relative imports (#60227) (#60556) 2025-03-26 07:05:23 -07:00
listener_spec.ts refactor(core): convert scripts within packages/core/test to relative imports (#60227) (#60556) 2025-03-26 07:05:23 -07:00
local_compilation_spec.ts refactor(core): convert scripts within packages/core/test to relative imports (#60227) (#60556) 2025-03-26 07:05:23 -07:00
ng_module_spec.ts refactor(core): convert scripts within packages/core/test to relative imports (#60227) (#60556) 2025-03-26 07:05:23 -07:00
ngmodule_scope_spec.ts refactor(core): convert scripts within packages/core/test to relative imports (#60227) (#60556) 2025-03-26 07:05:23 -07:00
outputs_spec.ts refactor(core): convert scripts within packages/core/test to relative imports (#60227) (#60556) 2025-03-26 07:05:23 -07:00
pending_tasks_spec.ts refactor(core): convert scripts within packages/core/test to relative imports (#60227) (#60556) 2025-03-26 07:05:23 -07:00
pipe_spec.ts build: migrate all ts_library in packages/core/test (#61571) 2025-05-21 16:04:42 +00:00
profiler_spec.ts refactor(core): convert scripts within packages/core/test to relative imports (#60227) (#60556) 2025-03-26 07:05:23 -07:00
property_binding_spec.ts refactor(core): convert scripts within packages/core/test to relative imports (#60227) (#60556) 2025-03-26 07:05:23 -07:00
property_interpolation_spec.ts refactor(core): convert scripts within packages/core/test to relative imports (#60227) (#60556) 2025-03-26 07:05:23 -07:00
providers_spec.ts build: migrate all ts_library in packages/core/test (#61571) 2025-05-21 16:04:42 +00:00
pure_function_spec.ts refactor(core): convert scripts within packages/core/test to relative imports (#60227) (#60556) 2025-03-26 07:05:23 -07:00
query_spec.ts refactor(core): convert scripts within packages/core/test to relative imports (#60227) (#60556) 2025-03-26 07:05:23 -07:00
renderer_factory_spec.ts build: migrate all ts_library in packages/core/test (#61571) 2025-05-21 16:04:42 +00:00
router_integration_spec.ts refactor(core): convert scripts within packages/core/test to relative imports (#60227) (#60556) 2025-03-26 07:05:23 -07:00
security_spec.ts fix(compiler): prevent XSS via SVG animation attributeName and MathML/SVG URLs 2025-12-01 10:28:38 +01:00
signal_debug_spec.ts refactor(core): convert scripts within packages/core/test to relative imports (#60227) (#60556) 2025-03-26 07:05:23 -07:00
standalone_injector_spec.ts refactor(core): convert scripts within packages/core/test to relative imports (#60227) (#60556) 2025-03-26 07:05:23 -07:00
standalone_spec.ts refactor(core): convert scripts within packages/core/test to relative imports (#60227) (#60556) 2025-03-26 07:05:23 -07:00
styling_spec.ts build: migrate all ts_library in packages/core/test (#61571) 2025-05-21 16:04:42 +00:00
template_ref_spec.ts refactor(core): convert scripts within packages/core/test to relative imports (#60227) (#60556) 2025-03-26 07:05:23 -07:00
text_spec.ts refactor(core): convert scripts within packages/core/test to relative imports (#60227) (#60556) 2025-03-26 07:05:23 -07:00
tracing_spec.ts refactor(core): convert scripts within packages/core/test to relative imports (#60227) (#60556) 2025-03-26 07:05:23 -07:00
view_container_ref_spec.ts build: migrate all ts_library in packages/core/test (#61571) 2025-05-21 16:04:42 +00:00
view_insertion_spec.ts refactor(core): convert scripts within packages/core/test to relative imports (#60227) (#60556) 2025-03-26 07:05:23 -07:00
view_ref_spec.ts refactor(core): convert scripts within packages/core/test to relative imports (#60227) (#60556) 2025-03-26 07:05:23 -07:00