fix(core): sanitize anchor protocol bindings#69219
Conversation
Treat `protocol` property bindings on `<a>` and `<area>` as URL contexts. This prevents a sanitized `href` from being re-schemed into an executable `javascript:` URL by a later protocol property write.
915e1ae to
00a7f6f
Compare
There was a problem hiding this comment.
I'm not entirely sure this is the right fix. The root issue might lies in the schema itself: https://github.com/angular/angular/blob/255151a41349c519728651739412dbd0f6138e13/packages/compiler/src/schema/dom_element_schema_registry.ts%23L99-L100
Setting protocol directly on element isn't really valid. We should dig a bit deeper into why this was originally introduced, as there are a few other invalid properties listed there as well.
Let me check with the team to see if this is by design.
So, the solution might be to use |
|
@SkyZeroZx, no the solution would be to remove the non standard properties from the known elements schema. But this still need to discussed internally. |
Treat
protocolproperty bindings on<a>and<area>as URL contexts.This prevents a sanitized
hreffrom being re-schemed into an executablejavascript:URL by a later protocol property write.See https://developer.mozilla.org/en-US/docs/Web/API/HTMLAnchorElement/protocol
More context https://issuetracker.google.com/u/1/issues/520794065