From 34c4e401bab65fad4d4494d1b987dace8a9819bd Mon Sep 17 00:00:00 2001 From: arturovt Date: Sat, 23 May 2026 23:16:02 +0300 Subject: [PATCH] fix(zone.js): validate __Zone_symbol_prefix to prevent DOM clobbering attacks MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Previously, `__Zone_symbol_prefix` was read directly from `globalThis` without validating its type: const symbolPrefix = global['__Zone_symbol_prefix'] || '__zone_symbol__'; This made it possible for DOM clobbering to interfere with Zone’s internal symbol handling. If an attacker injected a DOM element with the same name (for example via a form field or anchor ID), `global['__Zone_symbol_prefix']` could resolve to a DOM element instead of a string. Because DOM elements are truthy, the fallback would not be used, and Zone would construct invalid internal keys (e.g. “[object HTMLFormElement]...”), breaking patching and lookup logic in subtle ways. This prevents DOM clobbering from influencing Zone’s internal symbol generation and keeps the patching system stable even in the presence of malicious or unexpected global values. (cherry picked from commit e50f504b2f7d1cdb3504536466e14244219ba44f) --- packages/zone.js/lib/zone-impl.ts | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/packages/zone.js/lib/zone-impl.ts b/packages/zone.js/lib/zone-impl.ts index 1cc8c6433f7..f0e01ee2c0e 100644 --- a/packages/zone.js/lib/zone-impl.ts +++ b/packages/zone.js/lib/zone-impl.ts @@ -762,10 +762,12 @@ export type AmbientZone = Zone; const global = globalThis as any; -// __Zone_symbol_prefix global can be used to override the default zone -// symbol prefix with a custom one if needed. +// __Zone_symbol_prefix can be set globally to override the default zone symbol prefix. export function __symbol__(name: string) { - const symbolPrefix = global['__Zone_symbol_prefix'] || '__zone_symbol__'; + const rawPrefix = global['__Zone_symbol_prefix']; + // Guard against DOM clobbering: an attacker can set __Zone_symbol_prefix to an HTMLElement + // via e.g. , so we only trust it if it's actually a string. + const symbolPrefix = typeof rawPrefix === 'string' ? rawPrefix : '__zone_symbol__'; return symbolPrefix + name; }