fix(core): harden TransferState restoration against DOM clobbering - #69064
Conversation
Reject non-script elements when reading the SSR transfer state payload by id. This prevents attacker-controlled elements with a clobbered id from spoofing hydration state.
| @@ -154,7 +154,7 @@ export function retrieveTransferredState( | |||
| // Locate the script tag with the JSON data transferred from the server. | |||
| // The id of the script tag is set to the Angular appId + 'state'. | |||
| const script = doc.getElementById(appId + '-state'); | |||
There was a problem hiding this comment.
I think we can use querySelectorAll, and if we find more than one match it throws an error (if I'm not mistaken, this only had one at a time).
By the way, I had reported this before, but I haven't received a response yet. I'm not sure if there might be any additional detail here that could help us.
|
I see that you just added the If you want your PR to be merged, it has to pass all the CI checks. If you can't get the PR to a green state due to flakes or broken |
|
caretaker note: presubmit failure is a flake, this is good to go |
|
This pull request has been automatically locked due to inactivity. Read more about our automatic conversation locking policy. This action has been performed automatically by a bot. |
Reject non-script elements when reading the SSR transfer state payload by id. This prevents attacker-controlled elements with a clobbered id from spoofing hydration state.