angular__angular

mirror of https://github.com/angular/angular.git synced 2026-09-14 13:54:52 +08:00

Files

T

Alan Agius 7c42e2ebeb fix(compiler): prevent XSS via SVG animation attributeName and MathML/SVG URLs

This commit implements a security fix to prevent XSS vulnerabilities where SVG animation elements (`<animate>`, `<set>`, etc.) could be used to modify the `href` or `xlink:href` attributes of other elements to `javascript:` URLs.

The fix introduces a runtime validation step:
- A new [ɵɵValidateAttribute](cci:1://file:///usr/local/google/home/alanagius/git/angular/packages/core/src/sanitization/sanitization.ts:276:0-288:1) instruction is used when `attributeName` is bound on SVG animation elements.
- If executed, a `RuntimeError` is thrown, preventing the binding.
- The compiler now identifies `attributeName` on SVG animation elements as security-sensitive and injects this validation.

Additionally, the DOM security schema has been updated to include a comprehensive list of MathML and SVG elements that accept `href` or `xlink:href` attributes, ensuring they are correctly treated as `SecurityContext.URL` and sanitized. This prevents malicious URLs from being bound to these attributes.

http://b/463880509

2025-12-01 10:28:38 +01:00

public-api

fix(compiler): prevent XSS via SVG animation attributeName and MathML/SVG URLs

2025-12-01 10:28:38 +01:00

size-tracking

fix(core): cleanup testability subscriptions (#61261 )

2025-05-21 12:06:24 +00:00

BUILD.bazel

build: use api-golden tool from dev-infra for testing public API (#42688 )

2021-06-30 11:43:48 -07:00

README.md

build: remove circular deps goldens (#60021 )

2025-02-19 21:01:32 +00:00

README.md

`public-api/`

This directory contains all of the public api goldens for our npm packages we publish to NPM. These are tested on all PRs and commits as part of our bazel tests.

To check or update the public api goldens, run one of the following commands:

yarn public-api:check
yarn public-api:update