Elgato_dark/angular
1
0
Fork 0
mirror of https://github.com/angular/angular synced 2026-05-24 09:28:37 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1
angular/packages
History
Biswa 4e56595866 fix(service-worker): prevent open redirect via protocol-relative URLs 
This fix addresses an open redirect vulnerability in the Service Worker where
protocol-relative URLs (e.g., //evil.com) could be used to redirect users to
attacker-controlled domains via push notifications.

Changes:
- driver.ts: Add validation to reject protocol-relative URLs (//) and
  backslash-prefixed URLs (\) in notification action URLs
- driver.ts: Use URL.canParse() to allow explicit absolute URLs while
  properly handling relative URLs
- adapter.ts: Add validation to reject protocol-relative URLs in parseUrl
- Add unit tests for security validation in notification click handling

Fixes: Open redirect vulnerability in push notification handling
2026-05-03 16:06:49 +05:30
..
animations test: remove duplicate tests (#67518) 2026-03-11 13:37:33 -07:00
benchpress build: update cross-repo angular dependencies 2026-03-05 11:43:25 -08:00
common refactor(http): Add reportUploadProgress & reportDownloadProgress options 2026-05-01 16:00:00 -07:00
compiler refactor(core): Makes @defer(hydrate ...) runtime tree-shakable 2026-05-01 15:54:55 -07:00
compiler-cli test: add NgModule compliance test with 'bootstrap' & local compilation 2026-05-01 15:58:05 -07:00
core refactor(migrations): fix incremental-hydration migration 2026-05-01 16:01:28 -07:00
docs/di build: format md files 2025-11-06 10:03:05 -08:00
elements refactor(core): remove ComponentFactoryResolver usages 2026-04-13 16:00:03 +03:00
examples feat(core): bootstrap via ApplicationRef with config 2026-04-07 12:48:53 -07:00
forms refactor(forms): improve clarity in SelectMultipleControlValueAccessor.writeValue 2026-05-01 16:02:34 -07:00
language-service Revert "fix(language-service): Add support for @Input with transforms" 2026-05-01 11:05:56 -07:00
localize fix(localize): validate locale in getOutputPathFn to prevent path traversal 2026-03-30 12:15:26 +02:00
misc/angular-in-memory-web-api ci: remove remainings of saucelabs tests 2026-04-22 14:41:03 -07:00
platform-browser refactor(core): Don't throw when there are not async metadata 2026-04-27 17:04:09 -07:00
platform-browser-dynamic refactor(core): Don't throw when there are not async metadata 2026-04-27 17:04:09 -07:00
platform-server refactor(core): Makes @defer(hydrate ...) runtime tree-shakable 2026-05-01 15:54:55 -07:00
private/testing build: consolidate domino bundling in platform-server 2026-03-25 13:31:05 -07:00
router feat(router): add unmatchedInputBehavior option to componentInputBinding 2026-05-01 16:04:52 -07:00
service-worker fix(service-worker): prevent open redirect via protocol-relative URLs 2026-05-03 16:06:49 +05:30
ssr/docs build: add node type for api extraction 2026-02-11 13:57:58 -08:00
upgrade refactor(core): remove ComponentFactoryResolver usages 2026-04-13 16:00:03 +03:00
zone.js test(zone.js): vitest patch for testing (#68395) 2026-04-30 15:44:35 -07:00
BUILD.bazel refactor(platform-browser): remove Hammer integration 2026-03-19 16:13:20 -07:00
circular-deps-test.conf.cjs build: use Node.js built-in TypeScript support for dev-infra scripts 2026-01-02 08:15:40 +01:00
empty.ts refactor: update license text to point to angular.dev (#57901) 2024-09-24 15:33:00 +02:00
goog.d.ts refactor: update license text to point to angular.dev (#57901) 2024-09-24 15:33:00 +02:00
license-banner.txt docs: update copyright year 2026-01-07 12:28:34 -05:00
package.json build: prepare for compiler-cli to be using ts_project (#61181) 2025-05-09 15:59:46 +00:00
README.md build: format md files 2025-11-06 10:03:05 -08:00
system.d.ts refactor: update packages/core:{core,src} to ts_project (#61275) 2025-05-14 12:01:51 +00:00
tsconfig-build.json Revert "refactor(compiler-cli): remove deep imports from compiler-cli (#64732)" 2025-11-06 13:09:01 -08:00
tsconfig-legacy-saucelabs.json ci: remove remainings of saucelabs tests 2026-04-22 14:41:03 -07:00
tsconfig-test.json
tsconfig.json feat(compiler-cli): enable type checking of host bindings by default (#63654) 2025-09-09 14:34:29 -07:00
tsec-exemption.json
types.d.ts refactor(platform-browser): remove Hammer integration 2026-03-19 16:13:20 -07:00

README.md

Angular

The sources for this package are in the main Angular repo. Please file issues and pull requests against that repo.

Usage information and reference details can be found in Angular documentation.

License: MIT