Alan Agius d04ddd73df fix(core): prevent binding unsafe attributes on SVG animation elements (#67797) ... SVG animation elements (`animate` and `set`) can be used to animate sensitive attributes like `href` or `xlink:href`. Binding to these animation attributes (like `to`, `from`, or `values`) with a sensitive target creates an XSS vector. This change mitigates this risk by: 1. Classifying `to`, `from`, and `values` on `<animate>` and `<set>` elements as `ATTRIBUTE_NO_BINDING` in the DOM security schema to prevent standard dynamic bindings. 2. Adding runtime validations in `ɵɵvalidateAttribute` to verify that `attributeName` is not a sensitive attribute (such as `href` or `xlink:href`) when processed by a set of `SECURITY_SENSITIVE_ATTRIBUTE_NAMES`. If it is, a runtime error `UNSAFE_ATTRIBUTE_BINDING` is thrown. 3. Adding regression tests in `integration_spec.ts` to ensure unsafe bindings throw an error while safe ones pass correctly. PR Close #67797		2026-04-01 11:43:59 +02:00
..
dom_element_schema_registry_spec.ts	fix(core): prevent binding unsafe attributes on SVG animation elements (#67797)	2026-04-01 11:43:59 +02:00
schema_extractor.ts	fix(compiler): add geolocation element to schema	2026-02-09 12:25:37 -08:00
trusted_types_sinks_spec.ts	fix(compiler): disallow translations of iframe src	2026-03-12 10:01:31 -07:00