Skip to content

Commit bd2423d

Browse files
AndrewKushnirAndrewKushnir
committed
Revert "refactor(compiler): remove unnecessary sanitization for safe attributes"
This reverts commit 128aef0.
1 parent ff4fa14 commit bd2423d

File tree

12 files changed

+60
-29
lines changed

12 files changed

+60
-29
lines changed

‎packages/compiler-cli/test/compliance/test_cases/r3_view_compiler_bindings/host_bindings/GOLDEN_PARTIAL.js‎

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -905,19 +905,18 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "0.0.0-PLACEHOLDE
905905
export class HostBindingImageDir {
906906
constructor() {
907907
this.evil = 'evil';
908-
this.nonEvil = 'nonEvil';
909908
}
910909
}
911910
HostBindingImageDir.ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "0.0.0-PLACEHOLDER", ngImport: i0, type: HostBindingImageDir, deps: [], target: i0.ɵɵFactoryTarget.Directive });
912-
HostBindingImageDir.ɵdir = i0.ɵɵngDeclareDirective({ minVersion: "14.0.0", version: "0.0.0-PLACEHOLDER", type: HostBindingImageDir, isStandalone: true, selector: "img[hostBindingImgDir]", host: { properties: { "innerHtml": "evil", "attr.style": "evil", "src": "nonEvil" } }, ngImport: i0 });
911+
HostBindingImageDir.ɵdir = i0.ɵɵngDeclareDirective({ minVersion: "14.0.0", version: "0.0.0-PLACEHOLDER", type: HostBindingImageDir, isStandalone: true, selector: "img[hostBindingImgDir]", host: { properties: { "innerHtml": "evil", "attr.style": "evil", "src": "evil" } }, ngImport: i0 });
913912
i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "0.0.0-PLACEHOLDER", ngImport: i0, type: HostBindingImageDir, decorators: [{
914913
type: Directive,
915914
args: [{
916915
selector: 'img[hostBindingImgDir]',
917916
host: {
918917
'[innerHtml]': 'evil',
919918
'[attr.style]': 'evil',
920-
'[src]': 'nonEvil',
919+
'[src]': 'evil',
921920
},
922921
}]
923922
}] });
@@ -970,7 +969,6 @@ export declare class HostBindingLinkDir {
970969
}
971970
export declare class HostBindingImageDir {
972971
evil: string;
973-
nonEvil: string;
974972
static ɵfac: i0.ɵɵFactoryDeclaration<HostBindingImageDir, never>;
975973
static ɵdir: i0.ɵɵDirectiveDeclaration<HostBindingImageDir, "img[hostBindingImgDir]", never, {}, {}, never, never, true, never>;
976974
}

‎packages/compiler-cli/test/compliance/test_cases/r3_view_compiler_bindings/host_bindings/sanitization.js‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,14 +7,14 @@ hostBindings: function HostBindingLinkDir_HostBindings(rf, ctx) {
77
…
88
hostBindings: function HostBindingImageDir_HostBindings(rf, ctx) {
99
if (rf & 2) {
10-
$r3$.ɵɵdomProperty("innerHTML", ctx.evil, $r3$.ɵɵsanitizeHtml)("src", ctx.nonEvil);
10+
$r3$.ɵɵdomProperty("innerHTML", ctx.evil, $r3$.ɵɵsanitizeHtml)("src", ctx.evil, $r3$.ɵɵsanitizeUrl);
1111
$r3$.ɵɵattribute("style", ctx.evil, $r3$.ɵɵsanitizeStyle);
1212
}
1313
}
1414
…
1515
hostBindings: function HostBindingIframeDir_HostBindings(rf, ctx) {
1616
if (rf & 2) {
17-
$r3$.ɵɵdomProperty("innerHTML", ctx.evil, $r3$.ɵɵsanitizeHtml)("src", ctx.evil, i0.ɵɵsanitizeResourceUrl)("sandbox", ctx.evil, $r3$.ɵɵvalidateAttribute);
17+
$r3$.ɵɵdomProperty("innerHTML", ctx.evil, $r3$.ɵɵsanitizeHtml)("src", ctx.evil, $r3$.ɵɵsanitizeResourceUrl)("sandbox", ctx.evil, $r3$.ɵɵvalidateAttribute);
1818
$r3$.ɵɵattribute("style", ctx.evil, $r3$.ɵɵsanitizeStyle)("attributeName", ctx.nonEvil);
1919
}
2020
}

‎packages/compiler-cli/test/compliance/test_cases/r3_view_compiler_bindings/host_bindings/sanitization.ts‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,12 +17,11 @@ export class HostBindingLinkDir {
1717
host: {
1818
'[innerHtml]': 'evil',
1919
'[attr.style]': 'evil',
20-
'[src]': 'nonEvil',
20+
'[src]': 'evil',
2121
},
2222
})
2323
export class HostBindingImageDir {
2424
evil = 'evil';
25-
nonEvil = 'nonEvil';
2625
}
2726

2827
@Directive({

‎packages/compiler-cli/test/compliance/test_cases/r3_view_compiler_bindings/property_bindings/GOLDEN_PARTIAL.js‎

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -827,15 +827,14 @@ import * as i0 from "@angular/core";
827827
export class MyComponent {
828828
constructor() {
829829
this.evil = 'evil';
830-
this.nonEvil = 'nonEvil';
831830
}
832831
}
833832
MyComponent.ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "0.0.0-PLACEHOLDER", ngImport: i0, type: MyComponent, deps: [], target: i0.ɵɵFactoryTarget.Component });
834833
MyComponent.ɵcmp = i0.ɵɵngDeclareComponent({ minVersion: "14.0.0", version: "0.0.0-PLACEHOLDER", type: MyComponent, isStandalone: true, selector: "my-component", ngImport: i0, template: `
835834
<div [innerHtml]="evil"></div>
836835
<link [href]="evil" />
837836
<div [attr.style]="evil"></div>
838-
<img [src]="nonEvil" />
837+
<img [src]="evil" />
839838
<iframe [sandbox]="evil"></iframe>
840839
<a href="{{evil}}{{evil}}"></a>
841840
<div attr.style="{{evil}}{{evil}}"></div>
@@ -848,7 +847,7 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "0.0.0-PLACEHOLDE
848847
<div [innerHtml]="evil"></div>
849848
<link [href]="evil" />
850849
<div [attr.style]="evil"></div>
851-
<img [src]="nonEvil" />
850+
<img [src]="evil" />
852851
<iframe [sandbox]="evil"></iframe>
853852
<a href="{{evil}}{{evil}}"></a>
854853
<div attr.style="{{evil}}{{evil}}"></div>
@@ -862,7 +861,6 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "0.0.0-PLACEHOLDE
862861
import * as i0 from "@angular/core";
863862
export declare class MyComponent {
864863
evil: string;
865-
nonEvil: string;
866864
static ɵfac: i0.ɵɵFactoryDeclaration<MyComponent, never>;
867865
static ɵcmp: i0.ɵɵComponentDeclaration<MyComponent, "my-component", never, {}, {}, never, never, true, never>;
868866
}

‎packages/compiler-cli/test/compliance/test_cases/r3_view_compiler_bindings/property_bindings/sanitization.js‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ template: function MyComponent_Template(rf, ctx) {
99
$r3$.ɵɵadvance();
1010
$r3$.ɵɵattribute("style", ctx.evil, $r3$.ɵɵsanitizeStyle);
1111
$r3$.ɵɵadvance();
12-
$r3$.ɵɵdomProperty("src", ctx.nonEvil);
12+
$r3$.ɵɵdomProperty("src", ctx.evil, $r3$.ɵɵsanitizeUrl);
1313
$r3$.ɵɵadvance();
1414
$r3$.ɵɵdomProperty("sandbox", ctx.evil, $r3$.ɵɵvalidateAttribute);
1515
$r3$.ɵɵadvance();

‎packages/compiler-cli/test/compliance/test_cases/r3_view_compiler_bindings/property_bindings/sanitization.ts‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,13 +6,12 @@ import {Component} from '@angular/core';
66
<div [innerHtml]="evil"></div>
77
<link [href]="evil" />
88
<div [attr.style]="evil"></div>
9-
<img [src]="nonEvil" />
9+
<img [src]="evil" />
1010
<iframe [sandbox]="evil"></iframe>
1111
<a href="{{evil}}{{evil}}"></a>
1212
<div attr.style="{{evil}}{{evil}}"></div>
1313
`
1414
})
1515
export class MyComponent {
1616
evil = 'evil';
17-
nonEvil = 'nonEvil';
1817
}

‎packages/compiler-cli/test/ngtsc/ngtsc_spec.ts‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8497,7 +8497,7 @@ runInEachFileSystem((os: string) => {
84978497
hostVars: 6,
84988498
hostBindings: function UnsafeAttrsDirective_HostBindings(rf, ctx) {
84998499
if (rf & 2) {
8500-
i0.ɵɵattribute("href", ctx.attrHref, i0.ɵɵsanitizeUrlOrResourceUrl)("src", ctx.attrSrc, i0.ɵɵsanitizeResourceUrl)("action", ctx.attrAction, i0.ɵɵsanitizeUrl)("profile", ctx.attrProfile)("innerHTML", ctx.attrInnerHTML, i0.ɵɵsanitizeHtml)("title", ctx.attrSafeTitle);
8500+
i0.ɵɵattribute("href", ctx.attrHref, i0.ɵɵsanitizeUrlOrResourceUrl)("src", ctx.attrSrc, i0.ɵɵsanitizeUrlOrResourceUrl)("action", ctx.attrAction, i0.ɵɵsanitizeUrl)("profile", ctx.attrProfile, i0.ɵɵsanitizeResourceUrl)("innerHTML", ctx.attrInnerHTML, i0.ɵɵsanitizeHtml)("title", ctx.attrSafeTitle);
85018501
}
85028502
}
85038503
`;

‎packages/compiler/src/schema/dom_security_schema.ts‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,9 +32,23 @@ export function SECURITY_SCHEMA(): {[k: string]: SecurityContext} {
3232
registerContext(SecurityContext.URL, [
3333
'*|formAction',
3434
'area|href',
35+
'area|ping',
36+
'audio|src',
3537
'a|href',
3638
'a|xlink:href',
39+
'a|ping',
40+
'blockquote|cite',
41+
'body|background',
42+
'del|cite',
3743
'form|action',
44+
'img|src',
45+
'input|src',
46+
'ins|cite',
47+
'q|cite',
48+
'source|src',
49+
'track|src',
50+
'video|poster',
51+
'video|src',
3852

3953
// MathML namespace
4054
// https://crsrc.org/c/third_party/blink/renderer/core/sanitizer/sanitizer.cc;l=753-768;drc=b3eb16372dcd3317d65e9e0265015e322494edcd;bpv=1;bpt=1
@@ -107,11 +121,16 @@ export function SECURITY_SCHEMA(): {[k: string]: SecurityContext} {
107121
]);
108122

109123
registerContext(SecurityContext.RESOURCE_URL, [
124+
'applet|code',
125+
'applet|codebase',
110126
'base|href',
111127
'embed|src',
112128
'frame|src',
129+
'head|profile',
130+
'html|manifest',
113131
'iframe|src',
114132
'link|href',
133+
'media|src',
115134
'object|codebase',
116135
'object|data',
117136
'script|src',

‎packages/compiler/test/schema/dom_element_schema_registry_spec.ts‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -156,6 +156,7 @@ If 'onAnything' is a directive input, make sure the directive is imported by the
156156
expect(registry.securityContext('p', 'innerHTML', false)).toBe(SecurityContext.HTML);
157157
expect(registry.securityContext('a', 'href', false)).toBe(SecurityContext.URL);
158158
expect(registry.securityContext('a', 'style', false)).toBe(SecurityContext.STYLE);
159+
expect(registry.securityContext('ins', 'cite', false)).toBe(SecurityContext.URL);
159160
expect(registry.securityContext('base', 'href', false)).toBe(SecurityContext.RESOURCE_URL);
160161
});
161162

‎packages/core/test/acceptance/host_binding_spec.ts‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1607,6 +1607,23 @@ describe('host bindings', () => {
16071607
true,
16081608
true,
16091609
);
1610+
verify(
1611+
'blockquote',
1612+
'cite',
1613+
'javascript:alert(2)',
1614+
'unsafe:javascript:alert(2)',
1615+
bypassSanitizationTrustUrl,
1616+
);
1617+
verify('blockquote', 'cite', 'javascript:alert(2.1)', 'unsafe:javascript:alert(2.1)', identity);
1618+
verify(
1619+
'blockquote',
1620+
'cite',
1621+
'javascript:alert(2.2)',
1622+
'unsafe:javascript:alert(2.2)',
1623+
bypassSanitizationTrustHtml,
1624+
true,
1625+
true,
1626+
);
16101627
verify(
16111628
'b',
16121629
'innerHTML',

0 commit comments

Comments
 (0)