skills/angular__angular
1
0
Fork 0
mirror of https://github.com/angular/angular.git synced 2026-09-14 13:54:52 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix(compiler): disallow i18n event attributes

Browse Source 
Reject translated event-handler attributes so localization cannot bypass Angular event-attribute validation.
This commit is contained in:
Hexix23
2026-05-20 14:18:39 +02:00
committed by Alex Rickabaugh
parent f34a93c946
commit e2660c3dee
2 changed files with 10 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/compiler/src/render3/view/i18n/meta.ts
+1 -1
View File
@@ -208,7 +208,7 @@ export class I18nMetaVisitor implements html.Visitor {
isTrustedType = isTrustedTypesSink(node.name, name);
}
if (isTrustedType) {
if (isTrustedType || name.toLowerCase().startsWith('on')) {
this._reportError(
attr,
`Translating attribute '${name}' is disallowed for security reasons.`,
packages/core/test/linker/security_integration_spec.ts
+9
View File
@@ -368,6 +368,15 @@ describe('security integration tests', function () {
expect(link.getAttribute('href')).toEqual('unsafe:javascript:alert(1)');
});
it('should throw error on translated event attributes', () => {
const template = `<img src="/missing-image.png" onerror="void 0" i18n-onerror>`;
TestBed.overrideComponent(SecuredComponent, {set: {template}});
expect(() => TestBed.createComponent(SecuredComponent)).toThrowError(
/Translating attribute 'onerror' is disallowed for security reasons./,
);
});
it('should throw error on security-sensitive attributes with constant values', () => {
const template = `<iframe srcdoc="foo" i18n-srcdoc></iframe>`;
TestBed.overrideComponent(SecuredComponent, {set: {template}});