feat(core): support passing Trusted Types around sanitization pipeline#39217
Closed
bjarkler wants to merge 2 commits into
Closed
feat(core): support passing Trusted Types around sanitization pipeline#39217bjarkler wants to merge 2 commits into
bjarkler wants to merge 2 commits into
Conversation
14 tasks
1b0b057 to
e73ea66
Compare
23 tasks
9a8d7bb to
765f91d
Compare
f14b66d to
0480af1
Compare
Sanitizers in Angular currently return strings, which will then eventually make their way down to the DOM, e.g. as the value of an attribute or property. This may cause a Trusted Types violation. As a step towards fixing that, make it possible to return Trusted Types from the SanitizerFn interface, which represents the internal sanitization pipeline. DOM renderer interfaces are also updated to reflect the fact that setAttribute and setAttributeNS must be able to accept Trusted Types.
Make Angular's HTML sanitizer return a TrustedHTML, as its output is trusted not to cause XSS vulnerabilities when used in a context where a browser may parse and evaluate HTML. Also update tests to reflect the new behaviour.
0480af1 to
e51f402
Compare
Contributor
Author
IgorMinar
suggested changes
Oct 16, 2020
IgorMinar
left a comment
Contributor
There was a problem hiding this comment.
Reviewed-for: fw-security
Contributor
Author
|
You're right, closing in favor of #39218. |
|
This issue has been automatically locked due to inactivity. Read more about our automatic conversation locking policy. This action has been performed automatically by a bot. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Angular's sanitization pipeline is an application's last line of defence against XSS vulnerabilities. However, it currently outputs plain strings that are then passed to the DOM, where they may cause Trusted Types violations. As a step towards fixing that, make it possible to return Trusted Types from the sanitization pipeline.
This is based on #39207. See the individual commits for more details.
PR Checklist
Please check if your PR fulfills the following requirements:
PR Type
What kind of change does this PR introduce?
Does this PR introduce a breaking change?
Other information
This is part of an ongoing effort to add support for Trusted Types to Angular.