docs: add NG05201 - #69504
Conversation
188b137 to
1df1c1f
Compare
1df1c1f to
1294666
Compare
| @@ -0,0 +1,43 @@ | |||
| # Unsafe value used in a resource URL context | |||
|
|
|||
| Angular throws this error when you bind a value to an attribute that loads an external resource — like `<iframe src>`, `<script src>`, or `<link href>` — and that value hasn't been explicitly marked as trusted. | |||
There was a problem hiding this comment.
As I mentioned earlier, the script wouldn't apply since it's not possible to write it in a template and due to its nature
EDIT : I'm referring to removing only <script src> since it doesn't add value and would be confusing because that case can't currently happen.
There was a problem hiding this comment.
So you're saying that is no way to get 5201 anymore because throw NG0904?
There was a problem hiding this comment.
As I understand and have reviewed,
-
We cannot write
scriptin the template in any way because the Ng Compiler will remove it. -
We cannot create components dynamically with
createComponentaccording to GHSA-692r-grfm-v8x7 and fix(core): reject dynamic script host elements #69551 and this would be the only case forNG0904
So, to summarize, I would say that it is no longer possible according to our current sanitization model.
The only way would be to create a script with document or Render2 , which is inherently unsafe according to the documentation because it occurs outside the scope of Angular.
Adds a reference page for `NG05200`, thrown by `DomSanitizer` when a value is bound to a `<script>` element without being marked trusted via `bypassSecurityTrustScript`. Covers why Angular rejects script content outright, how to reproduce the error, the escape hatch, and the XSS caveat.
1294666 to
24585f9
Compare
|
caretaker note: no need to presubmit, this is a doc only change. |
|
This pull request has been automatically locked due to inactivity. Read more about our automatic conversation locking policy. This action has been performed automatically by a bot. |
See individual commits.