fix(platform-browser): prevent XSS through style binding DOM clobbering - #70022
fix(platform-browser): prevent XSS through style binding DOM clobbering#70022SkyZeroZx wants to merge 3 commits into
Conversation
Recover the intrinsic CSSStyleDeclaration before applying or removing style bindings. HTML named-property resolution can otherwise make a form control named or identified as style shadow HTMLFormElement.style. This lets attacker-controlled keys from [style], [style.property], or NgStyle reach unrelated DOM sinks such as innerHTML and outerHTML, enabling same-origin script execution during rendering without an explicit trust bypass. Fixes angular#70021
|
I feel like this is really a hardening fix. I see little reason to have such a dynamic styles. |
JeanMeche
left a comment
There was a problem hiding this comment.
AGENT: I have left an inline suggestion to optimize the runtime performance of getStyleDeclaration for form elements.
Given that it's possible to generate forms with multiple JSON-based properties, adding a style-based customizations (It would suffice for them to be dynamic in any way, in any of the style forms, even if it's a string, that's enough for clobering currently) doesn't seem too strange to me personally, the first condition being somewhat normal at least in some projects I've seen. As an additional note, a quick search on GitHub suggests that applying style or ngStyle to forms isn't uncommon. The only additional requirement is that those values are dynamic, which is fairly plausible in CMSs, dashboards, or marketplaces. |
Recover the intrinsic
CSSStyleDeclarationbefore applying or removing style bindings. HTML named-property resolution can otherwise make a form control named or identified as style shadowHTMLFormElement.style.This lets attacker-controlled keys from
[style],[style.property], orNgStylereach unrelated DOM sinks such asinnerHTMLandouterHTML, enabling same-origin script execution during rendering without an explicit trust bypass.Fixes #70021
More context https://issuetracker.google.com/u/1/issues/540666920