Описание
Angular: Sanitization bypass via directive host bindings on concrete host elements in @angular/core and @angular/compiler
Angular automatically sanitizes untrusted values bound to security-sensitive DOM sinks (such as href, src, action, xlink:href, and data) to protect against Cross-Site Scripting (XSS).
Prior to the fix, the Angular compiler determined the SecurityContext for directive host bindings (host: {'[attr.href]': 'value'} or @HostBinding('attr.href')) based solely on the declaring directive or component selector at compile time, rather than the concrete host element that the directive was applied to.
When a directive with a security-sensitive host binding was applied to a different concrete host element—such as through:
hostDirectivescomposition,- Class inheritance of host bindings,
- Dynamic component instantiation (
createComponentwith customhostElementor dynamic directives), - Elements with SVG/MathML namespaces (e.g.
<svg:a>,<math>), or - Elements using tag-neutral selectors (e.g.
:not(...)),
the compiler either failed to associate a sanitizer with the host binding or attached an incorrect security context. As a result, untrusted inputs (e.g. javascript:... URLs) bound via the host binding would be written to the DOM attribute without passing through Angular's built-in sanitizer.
Impact
An attacker capable of controlling the value bound to an affected directive host binding could execute arbitrary JavaScript in the user's browser context (Cross-Site Scripting).
Patches
This issue has been resolved in versions:
22.1.021.2.2020.3.28
Workarounds
Ensure that any user-controlled values assigned to properties bound via directive host bindings are explicitly sanitized using DomSanitizer.sanitize(SecurityContext.URL, ...) before assignment, or restrict the input to validated safe URL schemes (e.g. http://, https://).
Ссылки
- https://github.com/angular/angular/security/advisories/GHSA-hh8m-fm6v-7cvg
- https://github.com/angular/angular/issues/69550
- https://github.com/angular/angular/pull/69558
- https://github.com/angular/angular/commit/2f96c8020f85ccb715a76de4b79a0c680c2c7264
- https://github.com/angular/angular/commit/6afe6fa781c2f0931f0aedd729b9884a8fe212ee
- https://github.com/angular/angular/commit/6caa298dee58319b2d674dc91364e26ffe3ecb2b
- https://github.com/angular/angular/releases/tag/v20.3.28
- https://github.com/angular/angular/releases/tag/v21.2.20
- https://github.com/angular/angular/releases/tag/v22.1.0
Пакеты
@angular/core
>= 22.0.0, < 22.1.0
22.1.0
@angular/compiler
>= 22.0.0, < 22.1.0
22.1.0
@angular/core
>= 21.0.0, < 21.2.20
21.2.20
@angular/compiler
>= 21.0.0, < 21.2.20
21.2.20
@angular/core
>= 20.0.0, < 20.3.28
20.3.28
@angular/compiler
>= 20.0.0, < 20.3.28
20.3.28
@angular/core
<= 19.2.25
Отсутствует
@angular/compiler
<= 19.2.25
Отсутствует
Связанные уязвимости
(Angular is a development platform for building mobile and desktop web ...)
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.28, 21.2.20, and 22.1.0, Angular's compiler and runtime in @angular/core and @angular/compiler could omit or select an incorrect sanitizer for security-sensitive directive host bindings because SecurityContext was derived from the declaring directive or component selector rather than the concrete host element. The mismatch is reachable through hostDirectives composition, inherited HostBinding declarations, createComponent with a custom hostElement or dynamic directives, SVG/MathML namespace elements, and tag-neutral selectors such as :not(...). Attacker-controlled href, src, action, xlink:href, or data values can therefore reach DOM attributes without Angular's built-in sanitizer and execute arbitrary JavaScript in the user's browser context. Applications unable to upgrade can use DomSanitizer.sanitize with SecurityContext.URL before assig...
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.28, 21.2.20, and 22.1.0, Angular's compiler and runtime in @angular/core and @angular/compiler could omit or select an incorrect sanitizer for security-sensitive directive host bindings because SecurityContext was derived from the declaring directive or component selector rather than the concrete host element. The mismatch is reachable through hostDirectives composition, inherited HostBinding declarations, createComponent with a custom hostElement or dynamic directives, SVG/MathML namespace elements, and tag-neutral selectors such as :not(...). Attacker-controlled href, src, action, xlink:href, or data values can therefore reach DOM attributes without Angular's built-in sanitizer and execute arbitrary JavaScript in the user's browser context. Applications unable to upgrade can use DomSanitizer.sanitize with SecurityContext.URL before assignme
Angular is a development platform for building mobile and desktop web ...