angular__angular

mirror of https://github.com/angular/angular.git synced 2026-09-14 13:54:52 +08:00

Files

T

Alan Agius ede7c58a2a fix(platform-server): prevent SSRF bypasses via protocol-relative and backslash URLs

The `parseUrl` function in `ServerPlatformLocation` uses `new URL(urlStr, origin)` to parse incoming request URLs during SSR. Per the WHATWG URL specification, protocol-relative URLs (`//evil.com`) and backslash-prefixed URLs (`/\evil.com`) can override the hostname component of the base URL.

This vulnerability typically manifests in SSR setups (e.g., Express) where `req.url` is passed directly to `renderApplication` or `renderModule`:

```typescript
// Example usage in an Express server handling: http://localhost:4000//evil.com
app.get('*', async (req, res) => {
  const html = await renderApplication(bootstrap, {
    document: template,
    url: req.url, // req.url is "//evil.com"
  });
  res.send(html);
});
```

2026-04-15 10:23:52 -04:00

init

build: consolidate domino bundling in platform-server

2026-03-25 13:31:05 -07:00

src

fix(platform-server): prevent SSRF bypasses via protocol-relative and backslash URLs

2026-04-15 10:23:52 -04:00

test

fix(platform-server): prevent SSRF bypasses via protocol-relative and backslash URLs

2026-04-15 10:23:52 -04:00

testing

…