Viacheslav Klimov
1 week ago
committed by
GitHub
GitHub
10 changed files with 186 additions and 22 deletions
@ -0,0 +1,66 @@ |
|||
diff --git a/node_modules/@angular/common/esm2022/http/src/xsrf.mjs b/node_modules/@angular/common/esm2022/http/src/xsrf.mjs
|
|||
index da69c17..d17f6ad 100755
|
|||
--- a/node_modules/@angular/common/esm2022/http/src/xsrf.mjs
|
|||
+++ b/node_modules/@angular/common/esm2022/http/src/xsrf.mjs
|
|||
@@ -19,6 +19,10 @@ export const XSRF_HEADER_NAME = new InjectionToken(ngDevMode ? 'XSRF_HEADER_NAME
|
|||
providedIn: 'root', |
|||
factory: () => XSRF_DEFAULT_HEADER_NAME, |
|||
}); |
|||
+/**
|
|||
+ * Regex to match absolute URLs, including protocol-relative URLs.
|
|||
+ */
|
|||
+const ABSOLUTE_URL_REGEX = /^(?:https?:)?\/\//i;
|
|||
/** |
|||
* Retrieves the current XSRF token to use with the next outgoing request. |
|||
* |
|||
@@ -69,7 +73,6 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "18.2.13", ngImpo
|
|||
args: [XSRF_COOKIE_NAME] |
|||
}] }] }); |
|||
export function xsrfInterceptorFn(req, next) { |
|||
- const lcUrl = req.url.toLowerCase();
|
|||
// Skip both non-mutating requests and absolute URLs. |
|||
// Non-mutating requests don't require a token, and absolute URLs require special handling |
|||
// anyway as the cookie set |
|||
@@ -77,8 +80,7 @@ export function xsrfInterceptorFn(req, next) {
|
|||
if (!inject(XSRF_ENABLED) || |
|||
req.method === 'GET' || |
|||
req.method === 'HEAD' || |
|||
- lcUrl.startsWith('http://') ||
|
|||
- lcUrl.startsWith('https://')) {
|
|||
+ ABSOLUTE_URL_REGEX.test(req.url)) {
|
|||
return next(req); |
|||
} |
|||
const token = inject(HttpXsrfTokenExtractor).getToken(); |
|||
diff --git a/node_modules/@angular/common/fesm2022/http.mjs b/node_modules/@angular/common/fesm2022/http.mjs
|
|||
index 1655480..d1dbb38 100755
|
|||
--- a/node_modules/@angular/common/fesm2022/http.mjs
|
|||
+++ b/node_modules/@angular/common/fesm2022/http.mjs
|
|||
@@ -2352,6 +2352,10 @@ const XSRF_HEADER_NAME = new InjectionToken(ngDevMode ? 'XSRF_HEADER_NAME' : '',
|
|||
providedIn: 'root', |
|||
factory: () => XSRF_DEFAULT_HEADER_NAME, |
|||
}); |
|||
+/**
|
|||
+ * Regex to match absolute URLs, including protocol-relative URLs.
|
|||
+ */
|
|||
+const ABSOLUTE_URL_REGEX = /^(?:https?:)?\/\//i;
|
|||
/** |
|||
* Retrieves the current XSRF token to use with the next outgoing request. |
|||
* |
|||
@@ -2402,7 +2406,6 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "18.2.13", ngImpo
|
|||
args: [XSRF_COOKIE_NAME] |
|||
}] }] }); |
|||
function xsrfInterceptorFn(req, next) { |
|||
- const lcUrl = req.url.toLowerCase();
|
|||
// Skip both non-mutating requests and absolute URLs. |
|||
// Non-mutating requests don't require a token, and absolute URLs require special handling |
|||
// anyway as the cookie set |
|||
@@ -2410,8 +2413,7 @@ function xsrfInterceptorFn(req, next) {
|
|||
if (!inject(XSRF_ENABLED) || |
|||
req.method === 'GET' || |
|||
req.method === 'HEAD' || |
|||
- lcUrl.startsWith('http://') ||
|
|||
- lcUrl.startsWith('https://')) {
|
|||
+ ABSOLUTE_URL_REGEX.test(req.url)) {
|
|||
return next(req); |
|||
} |
|||
const token = inject(HttpXsrfTokenExtractor).getToken(); |
|||
@ -0,0 +1,88 @@ |
|||
diff --git a/node_modules/@angular/compiler/fesm2022/compiler.mjs b/node_modules/@angular/compiler/fesm2022/compiler.mjs
|
|||
index a00b189..260e7be 100755
|
|||
--- a/node_modules/@angular/compiler/fesm2022/compiler.mjs
|
|||
+++ b/node_modules/@angular/compiler/fesm2022/compiler.mjs
|
|||
@@ -18631,6 +18631,7 @@ function SECURITY_SCHEMA() {
|
|||
'area|ping', |
|||
'audio|src', |
|||
'a|href', |
|||
+ 'a|xlink:href',
|
|||
'a|ping', |
|||
'blockquote|cite', |
|||
'body|background', |
|||
@@ -18644,6 +18645,75 @@ function SECURITY_SCHEMA() {
|
|||
'track|src', |
|||
'video|poster', |
|||
'video|src', |
|||
+
|
|||
+ // MathML namespace
|
|||
+ // https://crsrc.org/c/third_party/blink/renderer/core/sanitizer/sanitizer.cc;l=753-768;drc=b3eb16372dcd3317d65e9e0265015e322494edcd;bpv=1;bpt=1
|
|||
+ 'annotation|href',
|
|||
+ 'annotation|xlink:href',
|
|||
+ 'annotation-xml|href',
|
|||
+ 'annotation-xml|xlink:href',
|
|||
+ 'maction|href',
|
|||
+ 'maction|xlink:href',
|
|||
+ 'malignmark|href',
|
|||
+ 'malignmark|xlink:href',
|
|||
+ 'math|href',
|
|||
+ 'math|xlink:href',
|
|||
+ 'mroot|href',
|
|||
+ 'mroot|xlink:href',
|
|||
+ 'msqrt|href',
|
|||
+ 'msqrt|xlink:href',
|
|||
+ 'merror|href',
|
|||
+ 'merror|xlink:href',
|
|||
+ 'mfrac|href',
|
|||
+ 'mfrac|xlink:href',
|
|||
+ 'mglyph|href',
|
|||
+ 'mglyph|xlink:href',
|
|||
+ 'msub|href',
|
|||
+ 'msub|xlink:href',
|
|||
+ 'msup|href',
|
|||
+ 'msup|xlink:href',
|
|||
+ 'msubsup|href',
|
|||
+ 'msubsup|xlink:href',
|
|||
+ 'mmultiscripts|href',
|
|||
+ 'mmultiscripts|xlink:href',
|
|||
+ 'mprescripts|href',
|
|||
+ 'mprescripts|xlink:href',
|
|||
+ 'mi|href',
|
|||
+ 'mi|xlink:href',
|
|||
+ 'mn|href',
|
|||
+ 'mn|xlink:href',
|
|||
+ 'mo|href',
|
|||
+ 'mo|xlink:href',
|
|||
+ 'mpadded|href',
|
|||
+ 'mpadded|xlink:href',
|
|||
+ 'mphantom|href',
|
|||
+ 'mphantom|xlink:href',
|
|||
+ 'mrow|href',
|
|||
+ 'mrow|xlink:href',
|
|||
+ 'ms|href',
|
|||
+ 'ms|xlink:href',
|
|||
+ 'mspace|href',
|
|||
+ 'mspace|xlink:href',
|
|||
+ 'mstyle|href',
|
|||
+ 'mstyle|xlink:href',
|
|||
+ 'mtable|href',
|
|||
+ 'mtable|xlink:href',
|
|||
+ 'mtd|href',
|
|||
+ 'mtd|xlink:href',
|
|||
+ 'mtr|href',
|
|||
+ 'mtr|xlink:href',
|
|||
+ 'mtext|href',
|
|||
+ 'mtext|xlink:href',
|
|||
+ 'mover|href',
|
|||
+ 'mover|xlink:href',
|
|||
+ 'munder|href',
|
|||
+ 'munder|xlink:href',
|
|||
+ 'munderover|href',
|
|||
+ 'munderover|xlink:href',
|
|||
+ 'semantics|href',
|
|||
+ 'semantics|xlink:href',
|
|||
+ 'none|href',
|
|||
+ 'none|xlink:href',
|
|||
]); |
|||
registerContext(SecurityContext.RESOURCE_URL, [ |
|||
'applet|code', |
|||
Loading…
Reference in new issue