mirror of
https://github.com/angular/angular
synced 2026-05-24 09:28:37 +00:00
7d58b798c6
Translators are not allowed to write HTML which creates URI attributes. I opted to ban any values going into an attribute at all, to prevent even links to malicious content, rather than just sanitizing URIs.
I also converted this blocklist into an allowlist. Now, we only allowing setting known attributes (while sanitizing URI attributes). This significantly reduces risk of missing a vulnerable attribute and does not require an exhaustive list of all potential attributes.
BREAKING CHANGE: Angular now only applies known attributes from HTML in translated ICU content. Unknown attributes are dropped and not rendered.
(cherry picked from commit
|
||
|---|---|---|
| .. | ||
| global | ||
| primitives | ||
| resources | ||
| rxjs-interop | ||
| schematics | ||
| src | ||
| test | ||
| testing | ||
| BUILD.bazel | ||
| index.ts | ||
| package.json | ||
| PACKAGE.md | ||
| public_api.ts | ||
| tsconfig-build.json | ||
| tsconfig-test.json | ||