mirror of
https://github.com/angular/angular
synced 2026-05-24 09:28:37 +00:00
7c42e2ebeb
This commit implements a security fix to prevent XSS vulnerabilities where SVG animation elements (`<animate>`, `<set>`, etc.) could be used to modify the `href` or `xlink:href` attributes of other elements to `javascript:` URLs. The fix introduces a runtime validation step: - A new [ɵɵValidateAttribute](cci:1://file:///usr/local/google/home/alanagius/git/angular/packages/core/src/sanitization/sanitization.ts:276:0-288:1) instruction is used when `attributeName` is bound on SVG animation elements. - If executed, a `RuntimeError` is thrown, preventing the binding. - The compiler now identifies `attributeName` on SVG animation elements as security-sensitive and injects this validation. Additionally, the DOM security schema has been updated to include a comprehensive list of MathML and SVG elements that accept `href` or `xlink:href` attributes, ensuring they are correctly treated as `SecurityContext.URL` and sanitized. This prevents malicious URLs from being bound to these attributes. http://b/463880509 |
||
|---|---|---|
| .. | ||
| expression_parser | ||
| i18n | ||
| ml_parser | ||
| output | ||
| render3 | ||
| schema | ||
| template/pipeline | ||
| template_parser | ||
| assertions.ts | ||
| chars.ts | ||
| compiler.ts | ||
| compiler_facade_interface.ts | ||
| config.ts | ||
| constant_pool.ts | ||
| core.ts | ||
| injectable_compiler_2.ts | ||
| jit_compiler_facade.ts | ||
| parse_util.ts | ||
| resource_loader.ts | ||
| selector.ts | ||
| shadow_css.ts | ||
| style_url_resolver.ts | ||
| util.ts | ||
| version.ts | ||