5 Commits

Author SHA1 Message Date
Alan Agius bc55749698 fix(common): use cryptographically secure SHA-256 for transfer cache key generation
Replace the custom 64-bit non-cryptographic combined DJB2 hashing implementation in HttpTransferCache with a robust, pure JavaScript, synchronous SHA-256 algorithm.

Using DJB2 is vulnerable to pre-image and second-preimage attacks due to its small 64-bit keyspace and mathematical simplicity. An attacker could craft colliding request inputs to poison the cache, potentially causing a CDN or the application to serve the wrong cached response to legitimate users.

SHA-256 provides strong cryptographic collision resistance, preventing cache key collision attacks. A custom synchronous implementation is required because the Web Crypto API (`crypto.subtle.digest`) is asynchronous, whereas the transfer cache state lookup and interceptor flow must operate synchronously.

Also, update the unit tests to dynamically verify the custom SHA-256 output against the native Web Crypto API.
2026-06-05 09:47:53 -07:00
Matthieu Riegler 687c374826 feat(router): add a currentNavigation signal to the Router service. (#63011)
This new signal property is convenient to derive a `isNavigating` state.

`isNavigating = computed(() => !!this.router.currentNavigation())`

DEPRECATED: The Router.getCurrentNavigation method is deprecated. Use the Router.currentNavigation signal instead.

fixes #62958

PR Close #63011
2025-08-06 09:54:53 -07:00
Kristiyan Kostadinov ddf779e18f Revert "feat(router): add a currentNavigation signal to the Router service. (#62971)" (#63010)
This reverts commit d00b3fed58.

PR Close #63010
2025-08-05 18:02:56 +02:00
Matthieu Riegler d00b3fed58 feat(router): add a currentNavigation signal to the Router service. (#62971)
This new signal property is convenient to derive a `isNavigating` state.

`isNavigating = computed(() => !!this.router.currentNavigation())`

DEPRECATED: The Router.getCurrentNavigation method is deprecated. Use the Router.currentNavigation signal instead.

fixes #62958

PR Close #62971
2025-08-05 10:05:49 +02:00
Joey Perrott b0effa1cc3 ci: use new size tracking in integration tests (#62650)
Use the new size tracking within integration tests

PR Close #62650
2025-07-17 13:56:22 -04:00