mirror of
https://github.com/angular/angular.git
synced 2026-09-14 13:54:52 +08:00
Alan Agius
8569db8875
In server-side rendering (SSR) setups, passing request URLs directly to the lower-level rendering APIs `renderModule` or `renderApplication` can expose applications to Server-Side Request Forgery (SSRF) or Host Header Injection attacks via absolute-form request URLs. To mitigate these vulnerabilities at the framework layer, this commit introduces the `allowedHosts` option to `PlatformConfig` (supporting exact hostnames, wildcards like `*.example.com`, or `*` to allow all). During platform initialization inside `createServerPlatform`, the hostname of the request `url` is validated against the `allowedHosts` list. If the hostname is not authorized, bootstrap immediately throws a host validation error, preventing unauthorized rendering and silent SSRF bypasses. Closes #68436
12 lines
406 B
Python
12 lines
406 B
Python
# TODO(alanagius): Enable once Angular CLI supports allowedHosts for version 19.
|
|
# ng_integration_test(
|
|
# name = "test",
|
|
# # TODO(crisbeto): Pinned temporarily until the CLI is updated to support TS 5.5.
|
|
# pinned_npm_packages = ["typescript"],
|
|
# setup_chromium = True,
|
|
# track_payload_paths = [
|
|
# "/browser",
|
|
# ],
|
|
# track_payload_size = "platform-server-hydration",
|
|
# )
|