UI: Fix CVE-2025-66035

ui-ngx/patches/@angular+common+18.2.13.patch

@@ -0,0 +1,66 @@
+diff --git a/node_modules/@angular/common/esm2022/http/src/xsrf.mjs b/node_modules/@angular/common/esm2022/http/src/xsrf.mjs
+index da69c17..d17f6ad 100755
+--- a/node_modules/@angular/common/esm2022/http/src/xsrf.mjs
++++ b/node_modules/@angular/common/esm2022/http/src/xsrf.mjs
+@@ -19,6 +19,10 @@ export const XSRF_HEADER_NAME = new InjectionToken(ngDevMode ? 'XSRF_HEADER_NAME
+     providedIn: 'root',
+     factory: () => XSRF_DEFAULT_HEADER_NAME,
+ });
++/**
++ * Regex to match absolute URLs, including protocol-relative URLs.
++ */
++const ABSOLUTE_URL_REGEX = /^(?:https?:)?\/\//i;
+ /**
+  * Retrieves the current XSRF token to use with the next outgoing request.
+  *
+@@ -69,7 +73,6 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "18.2.13", ngImpo
+                     args: [XSRF_COOKIE_NAME]
+                 }] }] });
+ export function xsrfInterceptorFn(req, next) {
+-    const lcUrl = req.url.toLowerCase();
+     // Skip both non-mutating requests and absolute URLs.
+     // Non-mutating requests don't require a token, and absolute URLs require special handling
+     // anyway as the cookie set
+@@ -77,8 +80,7 @@ export function xsrfInterceptorFn(req, next) {
+     if (!inject(XSRF_ENABLED) ||
+         req.method === 'GET' ||
+         req.method === 'HEAD' ||
+-        lcUrl.startsWith('http://') ||
+-        lcUrl.startsWith('https://')) {
++        ABSOLUTE_URL_REGEX.test(req.url)) {
+         return next(req);
+     }
+     const token = inject(HttpXsrfTokenExtractor).getToken();
+diff --git a/node_modules/@angular/common/fesm2022/http.mjs b/node_modules/@angular/common/fesm2022/http.mjs
+index 1655480..d1dbb38 100755
+--- a/node_modules/@angular/common/fesm2022/http.mjs
++++ b/node_modules/@angular/common/fesm2022/http.mjs
+@@ -2352,6 +2352,10 @@ const XSRF_HEADER_NAME = new InjectionToken(ngDevMode ? 'XSRF_HEADER_NAME' : '',
+     providedIn: 'root',
+     factory: () => XSRF_DEFAULT_HEADER_NAME,
+ });
++/**
++ * Regex to match absolute URLs, including protocol-relative URLs.
++ */
++const ABSOLUTE_URL_REGEX = /^(?:https?:)?\/\//i;
+ /**
+  * Retrieves the current XSRF token to use with the next outgoing request.
+  *
+@@ -2402,7 +2406,6 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "18.2.13", ngImpo
+                     args: [XSRF_COOKIE_NAME]
+                 }] }] });
+ function xsrfInterceptorFn(req, next) {
+-    const lcUrl = req.url.toLowerCase();
+     // Skip both non-mutating requests and absolute URLs.
+     // Non-mutating requests don't require a token, and absolute URLs require special handling
+     // anyway as the cookie set
+@@ -2410,8 +2413,7 @@ function xsrfInterceptorFn(req, next) {
+     if (!inject(XSRF_ENABLED) ||
+         req.method === 'GET' ||
+         req.method === 'HEAD' ||
+-        lcUrl.startsWith('http://') ||
+-        lcUrl.startsWith('https://')) {
++        ABSOLUTE_URL_REGEX.test(req.url)) {
+         return next(req);
+     }
+     const token = inject(HttpXsrfTokenExtractor).getToken();