skills/angular__angular
1
0
Fork 0
mirror of https://github.com/angular/angular.git synced 2026-09-14 13:54:52 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix(core): guard against DOM clobbering in declareExperimentalWebMcpTool

Browse Source 
Previously, the modelContext truthiness check could be bypassed via DOM
clobbering (e.g. `<form id="modelContext">`), causing a truthy HTMLElement
to pass the guard and then throw when `registerTool` was called on it.

Replace the truthiness check with a duck-type check that asserts
`registerTool` is a function, rejecting both absent and clobbered values.
This commit is contained in:
arturovt
2026-06-17 18:53:02 +03:00
committed by Jessica Janiuk
parent 1e79dd3140
commit 8cf7731468
1 changed files with 4 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/core/src/webmcp/declare_tool.ts
+4 -2
View File
@@ -41,8 +41,10 @@ export function declareExperimentalWebMcpTool<const InputSchema extends JsonSche
(globalThis.document as {modelContext?: ModelContext}).modelContext ??
(globalThis.navigator as unknown as {modelContext?: ModelContext}).modelContext;
// Verify WebMCP is supported in this client.
if (!modelContext) return;
// Verify WebMCP is supported in this client. The typeof check guards against
// DOM clobbering (e.g. <form id="modelContext">), which would produce a truthy
// Element instead of a ModelContext object.
if (!modelContext || typeof modelContext.registerTool !== 'function') return;
if (typeof ngDevMode !== 'undefined' && ngDevMode) {
if (!injector) assertInInjectionContext(declareExperimentalWebMcpTool);