Thanks to visit codestin.com
Credit goes to github.com

Skip to content

fix(core): block creation of sensitive URI attributes from ICU messages #67183

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
thePunderWoman merged 1 commit into from
Feb 24, 2026
Merged

fix(core): block creation of sensitive URI attributes from ICU messages #67183

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
37 changes: 29 additions & 8 deletions packages/core/src/render3/i18n/i18n_parse.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -808,7 +808,6 @@ function walkIcuTree(
const attr = elAttrs.item(i)!;
const lowerAttrName = attr.name.toLowerCase();
const hasBinding = !!attr.value.match(BINDING_REGEXP);
// we assume the input string is safe, unless it's using a binding
if (hasBinding) {
if (VALID_ATTRS.hasOwnProperty(lowerAttrName)) {
if (URI_ATTRS[lowerAttrName]) {
Expand All @@ -831,8 +830,29 @@ function walkIcuTree(
`(see ${XSS_SECURITY_URL})`,
);
}
} else if (VALID_ATTRS[lowerAttrName]) {
if (URI_ATTRS[lowerAttrName]) {
// Don't sanitize, because no value is acceptable in sensitive attributes.
// Translators are not allowed to create URIs.
if (typeof ngDevMode !== 'undefined' && ngDevMode) {
console.warn(
`WARNING: ignoring unsafe attribute ` +
`${lowerAttrName} on element ${tagName} ` +
`(see ${XSS_SECURITY_URL})`,
);
}
addCreateAttribute(create, newIndex, attr.name, 'unsafe:blocked');
} else {
addCreateAttribute(create, newIndex, attr.name, attr.value);
}
} else {
addCreateAttribute(create, newIndex, attr);
if (typeof ngDevMode !== 'undefined' && ngDevMode) {
console.warn(
`WARNING: ignoring unknown attribute name ` +
`${lowerAttrName} on element ${tagName} ` +
`(see ${XSS_SECURITY_URL})`,
);
}
}
}
const elementNode: I18nElementNode = {
Expand Down Expand Up @@ -945,10 +965,11 @@ function addCreateNodeAndAppend(
);
}

function addCreateAttribute(create: IcuCreateOpCodes, newIndex: number, attr: Attr) {
create.push(
(newIndex << IcuCreateOpCode.SHIFT_REF) | IcuCreateOpCode.Attr,
attr.name,
attr.value,
);
function addCreateAttribute(
create: IcuCreateOpCodes,
newIndex: number,
attrName: string,
attrValue: string,
) {
create.push((newIndex << IcuCreateOpCode.SHIFT_REF) | IcuCreateOpCode.Attr, attrName, attrValue);
}
4 changes: 2 additions & 2 deletions packages/core/test/acceptance/i18n_spec.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3434,7 +3434,7 @@ describe('runtime i18n', () => {
{parameters.length, plural,
=1 {
Affects parameter
<span class="parameter-name" attr="should_be_present">{{ parameters[0].name }}</span>
<span class="parameter-name" label="should_be_present">{{ parameters[0].name }}</span>
}
other {
Affects {{parameters.length}} parameters, including
Expand All @@ -3453,7 +3453,7 @@ describe('runtime i18n', () => {
const fixture = TestBed.createComponent(MyApp);
fixture.detectChanges();
const span = (fixture.nativeElement as HTMLElement).querySelector('span')!;
expect(span.getAttribute('attr')).toEqual('should_be_present');
expect(span.getAttribute('label')).toEqual('should_be_present');
expect(span.getAttribute('class')).toEqual('parameter-name');
});

Expand Down
44 changes: 44 additions & 0 deletions packages/core/test/render3/i18n/i18n_parse_spec.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -297,6 +297,50 @@ describe('i18n_parse', () => {
);
});
});

it('should properly sanitize malicious URLs like `<a href="evil.test">` injected into translations', () => {
const tI18n = toT18n(`{
�0�, select,
A {<a href="javascript:console.log('hacked!');">malicious JS</a>}
other {<a href="https://evil.test">malicious link</a>}
}`);

fixture.apply(() => {
applyCreateOpCodes(fixture.lView, tI18n.create, fixture.host, null);
expect(fixture.host.innerHTML).toEqual(`<!--ICU ${HEADER_OFFSET + 0}:0-->`);
});

fixture.apply(() => {
ɵɵi18nExp('A');
ɵɵi18nApply(0);
expect(fixture.host.innerHTML).toEqual(
`<a href="unsafe:blocked">malicious JS</a><!--ICU ${HEADER_OFFSET + 0}:0-->`,
);
});

fixture.apply(() => {
ɵɵi18nExp('other');
ɵɵi18nApply(0);
expect(fixture.host.innerHTML).toEqual(
`<a href="unsafe:blocked">malicious link</a><!--ICU ${HEADER_OFFSET + 0}:0-->`,
);
});
});

it('should ignore unknown attributes', () => {
const tI18n = toT18n(`{�0�, select, A {<div unknown="unknown"></div>} }`);

fixture.apply(() => {
applyCreateOpCodes(fixture.lView, tI18n.create, fixture.host, null);
expect(fixture.host.innerHTML).toEqual(`<!--ICU ${HEADER_OFFSET + 0}:0-->`);
});

fixture.apply(() => {
ɵɵi18nExp('A');
ɵɵi18nApply(0);
expect(fixture.host.innerHTML).toEqual(`<div></div><!--ICU ${HEADER_OFFSET + 0}:0-->`);
});
});
});

function toT18n(text: string) {
Expand Down