fix(core): convert legacy-sanitized values to Trusted Types#39218
Closed
bjarkler wants to merge 4 commits into
Closed
fix(core): convert legacy-sanitized values to Trusted Types#39218bjarkler wants to merge 4 commits into
bjarkler wants to merge 4 commits into
Conversation
14 tasks
5466312 to
12f1ebb
Compare
23 tasks
4fb768d to
ac3f614
Compare
IgorMinar
suggested changes
Oct 13, 2020
IgorMinar
left a comment
Contributor
There was a problem hiding this comment.
the rest looks good to me.
ac3f614 to
8bd50c2
Compare
IgorMinar
approved these changes
Oct 13, 2020
IgorMinar
left a comment
Contributor
There was a problem hiding this comment.
this looks great to me now!
Reviewed-for: global-approvers, fw-security
Contributor
Author
|
There might still be typing issues with this PR (it modifies the ɵɵsanitize* instructions to return Trusted Types), so let's wait for the tests to pass before merging. |
2149a01 to
6d7547a
Compare
Sanitizers in Angular currently return strings, which will then eventually make their way down to the DOM, e.g. as the value of an attribute or property. This may cause a Trusted Types violation. As a step towards fixing that, make it possible to return Trusted Types from the SanitizerFn interface, which represents the internal sanitization pipeline. DOM renderer interfaces are also updated to reflect the fact that setAttribute and setAttributeNS must be able to accept Trusted Types.
Make Angular's HTML sanitizer return a TrustedHTML, as its output is trusted not to cause XSS vulnerabilities when used in a context where a browser may parse and evaluate HTML. Also update tests to reflect the new behaviour.
When an application uses a custom sanitizer or one of the bypassSecurityTrust functions, Angular has no way of knowing whether they are implemented in a secure way. (It doesn't even know if they're introduced by the application or by a shady third-party dependency.) Thus using Angular's main Trusted Types policy to bless values coming from these two sources would undermine the security that Trusted Types brings. Instead, introduce a Trusted Types policy called angular#unsafe-bypass specifically for blessing values from these sources. This allows an application to enforce Trusted Types even if their application uses a custom sanitizer or the bypassSecurityTrust functions, knowing that compromises to either of these two sources may lead to arbitrary script execution. In the future Angular will provide a way to implement custom sanitizers in a manner that makes better use of Trusted Types.
Use the bypass-specific Trusted Types policy for automatically upgrade any values from custom sanitizers or the bypassSecurityTrust functions to a Trusted Type. Update tests to reflect the new behavior.
6d7547a to
15b75c8
Compare
14 tasks
AndrewKushnir
pushed a commit
that referenced
this pull request
Oct 16, 2020
Make Angular's HTML sanitizer return a TrustedHTML, as its output is trusted not to cause XSS vulnerabilities when used in a context where a browser may parse and evaluate HTML. Also update tests to reflect the new behaviour. PR Close #39218
AndrewKushnir
pushed a commit
that referenced
this pull request
Oct 16, 2020
) When an application uses a custom sanitizer or one of the bypassSecurityTrust functions, Angular has no way of knowing whether they are implemented in a secure way. (It doesn't even know if they're introduced by the application or by a shady third-party dependency.) Thus using Angular's main Trusted Types policy to bless values coming from these two sources would undermine the security that Trusted Types brings. Instead, introduce a Trusted Types policy called angular#unsafe-bypass specifically for blessing values from these sources. This allows an application to enforce Trusted Types even if their application uses a custom sanitizer or the bypassSecurityTrust functions, knowing that compromises to either of these two sources may lead to arbitrary script execution. In the future Angular will provide a way to implement custom sanitizers in a manner that makes better use of Trusted Types. PR Close #39218
AndrewKushnir
pushed a commit
that referenced
this pull request
Oct 16, 2020
Use the bypass-specific Trusted Types policy for automatically upgrade any values from custom sanitizers or the bypassSecurityTrust functions to a Trusted Type. Update tests to reflect the new behavior. PR Close #39218
|
This issue has been automatically locked due to inactivity. Read more about our automatic conversation locking policy. This action has been performed automatically by a bot. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
When an application uses a custom sanitizer or one of the
bypassSecurityTrust functions, Angular has no way of knowing whether
they are implemented in a secure way. (It doesn't even know if they're
introduced by the application or by a shady third-party dependency.)
Thus using Angular's main Trusted Types policy to bless values coming
from these two sources would undermine the security that Trusted Types
brings.
Instead, introduce a Trusted Types policy called
angular#unsafe-legacy-bypass specifically for blessing values from these
sources. (The term legacy is used as there will be a new way of
implementing sanitizers that support Trusted Types.) This allows an
application to enforce Trusted Types even when their sanitizer or
bypassSecurityTrust function calls have not been migrated, knowing that
compromises to either of these two sources may lead to arbitrary script
execution.
Applications that have migrated to the new Trusted Types compatible
sanitizers should not allow the angular#unsafe-legacy-bypass policy.
This is based on #39217. See the individual commits for more details.
PR Checklist
Please check if your PR fulfills the following requirements:
PR Type
What kind of change does this PR introduce?
Does this PR introduce a breaking change?
Other information
This is part of an ongoing effort to add support for Trusted Types to Angular.