fix(@angular/build): prevent HTML injection from inlined font CSS - #33552
fix(@angular/build): prevent HTML injection from inlined font CSS#33552SkyZeroZx wants to merge 1 commit into
Conversation
Remote font CSS is embedded into a raw-text style element. Escape closing style tags so a compromised allowlisted response cannot terminate the style element and inject nonce-bearing markup.
There was a problem hiding this comment.
Code Review
This pull request addresses a potential security vulnerability by escaping closing style tags (e.g., </style>) within inlined CSS content to prevent them from prematurely terminating the generated raw-text style element. It also adds a corresponding unit test to verify that closing style tags are correctly escaped and do not lead to arbitrary HTML injection. I have no feedback to provide as there are no review comments.
|
Thanks for the contribution. In practice, font stylesheets are fetched strictly over HTTPS from a hardcoded allowlist of trusted origins ( |
Remote font CSS is embedded into a raw-text style element. Escape closing style tags so a compromised allowlisted response cannot terminate the style element and inject nonce-bearing markup.
For example, an attacker controlling the CSS response from an allowlisted font provider ,through provider, cache, or trusted HTTPS proxy compromise , could include
</style><script>evil</script>.During a production build, Angular embedded this response inside a
<style>element, turning external CSS into executable first-party JavaScript. If the application used ngCspNonce, later processing also copied the trusted nonce onto the injected script, allowing it to execute under a nonce based CSP. This commit neutralizes closing</style>sequences before embedding the CSS into generated HTML.