From d276eb8506b0ad445e466391e9fd7ccd68b8ac61 Mon Sep 17 00:00:00 2001 From: fg0x0 Date: Fri, 5 Jun 2026 04:06:22 +0800 Subject: [PATCH] fix(compiler): add base|href, frame|src, link|href to TRUSTED_TYPES_SINKS Incomplete fix of CVE-2026-32635. These three RESOURCE_URL attributes were missing from the Trusted Types sink list. --- packages/compiler/src/schema/trusted_types_sinks.ts | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/packages/compiler/src/schema/trusted_types_sinks.ts b/packages/compiler/src/schema/trusted_types_sinks.ts index 0d69ccee47f9..b8a8449665a0 100644 --- a/packages/compiler/src/schema/trusted_types_sinks.ts +++ b/packages/compiler/src/schema/trusted_types_sinks.ts @@ -28,6 +28,13 @@ const TRUSTED_TYPES_SINKS = new Set([ 'iframe|src', 'object|codebase', 'object|data', + + // RESOURCE_URL sinks missing from original Trusted Types integration. + // These are classified as RESOURCE_URL in dom_security_schema.ts and must + // be blocked in i18n attribute bindings (same as embed|src, iframe|src). + 'base|href', + 'frame|src', + 'link|href', ]); /**