UI: Fix CVE-2025-66412

8 months ago · f92e212383
1 changed files with 88 additions and 0 deletions
--- a/ui-ngx/patches/@angular+compiler+18.2.13.patch
+++ b/ui-ngx/patches/@angular+compiler+18.2.13.patch
@ -0,0 +1,88 @@
+diff --git a/node_modules/@angular/compiler/fesm2022/compiler.mjs b/node_modules/@angular/compiler/fesm2022/compiler.mjs
+index a00b189..260e7be 100755
+--- a/node_modules/@angular/compiler/fesm2022/compiler.mjs
+++ b/node_modules/@angular/compiler/fesm2022/compiler.mjs
+@@ -18631,6 +18631,7 @@ function SECURITY_SCHEMA() {
+             'area|ping',
+             'audio|src',
+             'a|href',
+            'a|xlink:href',
+             'a|ping',
+             'blockquote|cite',
+             'body|background',
+@@ -18644,6 +18645,75 @@ function SECURITY_SCHEMA() {
+             'track|src',
+             'video|poster',
+             'video|src',
+
+            // MathML namespace
+            // https://crsrc.org/c/third_party/blink/renderer/core/sanitizer/sanitizer.cc;l=753-768;drc=b3eb16372dcd3317d65e9e0265015e322494edcd;bpv=1;bpt=1
+            'annotation|href',
+            'annotation|xlink:href',
+            'annotation-xml|href',
+            'annotation-xml|xlink:href',
+            'maction|href',
+            'maction|xlink:href',
+            'malignmark|href',
+            'malignmark|xlink:href',
+            'math|href',
+            'math|xlink:href',
+            'mroot|href',
+            'mroot|xlink:href',
+            'msqrt|href',
+            'msqrt|xlink:href',
+            'merror|href',
+            'merror|xlink:href',
+            'mfrac|href',
+            'mfrac|xlink:href',
+            'mglyph|href',
+            'mglyph|xlink:href',
+            'msub|href',
+            'msub|xlink:href',
+            'msup|href',
+            'msup|xlink:href',
+            'msubsup|href',
+            'msubsup|xlink:href',
+            'mmultiscripts|href',
+            'mmultiscripts|xlink:href',
+            'mprescripts|href',
+            'mprescripts|xlink:href',
+            'mi|href',
+            'mi|xlink:href',
+            'mn|href',
+            'mn|xlink:href',
+            'mo|href',
+            'mo|xlink:href',
+            'mpadded|href',
+            'mpadded|xlink:href',
+            'mphantom|href',
+            'mphantom|xlink:href',
+            'mrow|href',
+            'mrow|xlink:href',
+            'ms|href',
+            'ms|xlink:href',
+            'mspace|href',
+            'mspace|xlink:href',
+            'mstyle|href',
+            'mstyle|xlink:href',
+            'mtable|href',
+            'mtable|xlink:href',
+            'mtd|href',
+            'mtd|xlink:href',
+            'mtr|href',
+            'mtr|xlink:href',
+            'mtext|href',
+            'mtext|xlink:href',
+            'mover|href',
+            'mover|xlink:href',
+            'munder|href',
+            'munder|xlink:href',
+            'munderover|href',
+            'munderover|xlink:href',
+            'semantics|href',
+            'semantics|xlink:href',
+            'none|href',
+            'none|xlink:href',
+         ]);
+         registerContext(SecurityContext.RESOURCE_URL, [
+             'applet|code',