angular__angular/integration/platform-server-hydration/size.json at 21.2.x - angular__angular - GetSkill.work

skills/angular__angular

mirror of https://github.com/angular/angular.git synced 2026-09-14 13:54:52 +08:00

Files

T

Alan Agius bc55749698 fix(common): use cryptographically secure SHA-256 for transfer cache key generation

Replace the custom 64-bit non-cryptographic combined DJB2 hashing implementation in HttpTransferCache with a robust, pure JavaScript, synchronous SHA-256 algorithm.

Using DJB2 is vulnerable to pre-image and second-preimage attacks due to its small 64-bit keyspace and mathematical simplicity. An attacker could craft colliding request inputs to poison the cache, potentially causing a CDN or the application to serve the wrong cached response to legitimate users.

SHA-256 provides strong cryptographic collision resistance, preventing cache key collision attacks. A custom synchronous implementation is required because the Web Crypto API (`crypto.subtle.digest`) is asynchronous, whereas the transfer cache state lookup and interceptor flow must operate synchronously.

Also, update the unit tests to dynamically verify the custom SHA-256 output against the native Web Crypto API.

2026-06-05 09:47:53 -07:00

6 lines

143 B

JSON

Raw Permalink Blame History

 {
   "dist/browser/main-[hash].js": 233303,
   "dist/browser/polyfills-[hash].js": 35677,
   "dist/browser/event-dispatch-contract.min.js": 476
 }