angular__angular

mirror of https://github.com/angular/angular.git synced 2026-09-14 13:54:52 +08:00

Files

T

Alan Agius 0b19c92d44 fix(platform-server): throw on suspicious URLs and restrict protocol-relative URLs

Currently, the platform-server attempts to neutralize URL hijacking and SSRF
bypasses by collapsing multiple leading slashes in relative paths. However,
sophisticated bypasses using obfuscated protocols (e.g., carriage returns or
newlines) or relative-like backslash paths can still lead to unexpected
origin takeovers.

This commit improves security by doing the following:
- Rejects protocol-relative URLs by throwing an error if they are not
  explicitly permitted via `allowProtocolRelative`.
- Strictly validates resolved URLs against the provided origin using
  `isSafeOriginChange`. If a URL unexpectedly shifts origins, an error
  is thrown.
- Permits origin changes only when standard absolute http/https protocols are
  explicitly declared in the input URL.

2026-06-01 20:03:22 +02:00

init

build: consolidate domino bundling in platform-server

2026-03-25 13:31:05 -07:00

src

fix(platform-server): throw on suspicious URLs and restrict protocol-relative URLs

2026-06-01 20:03:22 +02:00

test

fix(platform-server): throw on suspicious URLs and restrict protocol-relative URLs

2026-06-01 20:03:22 +02:00

testing

build: rename defaults2.bzl to defaults.bzl (#63383 )