Skip to content

fix(platform-browser): prevent XSS through style binding DOM clobbering - #70022

Open
SkyZeroZx wants to merge 3 commits into
angular:mainfrom
SkyZeroZx:fix-style-xss
Open

fix(platform-browser): prevent XSS through style binding DOM clobbering#70022
SkyZeroZx wants to merge 3 commits into
angular:mainfrom
SkyZeroZx:fix-style-xss

Conversation

@SkyZeroZx

@SkyZeroZx SkyZeroZx commented Jul 30, 2026

Copy link
Copy Markdown
Contributor

Recover the intrinsic CSSStyleDeclaration before applying or removing style bindings. HTML named-property resolution can otherwise make a form control named or identified as style shadow HTMLFormElement.style.

This lets attacker-controlled keys from [style], [style.property], or NgStyle reach unrelated DOM sinks such as innerHTML and outerHTML, enabling same-origin script execution during rendering without an explicit trust bypass.

Fixes #70021
More context https://issuetracker.google.com/u/1/issues/540666920

@angular-robot angular-robot Bot added the area: core Issues related to the framework runtime label Jul 30, 2026
@ngbot ngbot Bot added this to the Backlog milestone Jul 30, 2026
Recover the intrinsic CSSStyleDeclaration before applying or removing style bindings.

HTML named-property resolution can otherwise make a form control named or identified

as style shadow HTMLFormElement.style.

This lets attacker-controlled keys from [style], [style.property], or NgStyle reach

unrelated DOM sinks such as innerHTML and outerHTML, enabling same-origin script

execution during rendering without an explicit trust bypass.

Fixes angular#70021
@SkyZeroZx
SkyZeroZx marked this pull request as ready for review July 31, 2026 05:14
@pullapprove
pullapprove Bot requested a review from crisbeto July 31, 2026 05:14
@JeanMeche

Copy link
Copy Markdown
Member

I feel like this is really a hardening fix. I see little reason to have such a dynamic styles.

Comment thread packages/platform-browser/test/dom/dom_renderer_spec.ts Outdated

@JeanMeche JeanMeche left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

AGENT: I have left an inline suggestion to optimize the runtime performance of getStyleDeclaration for form elements.

Comment thread packages/platform-browser/src/dom/dom_renderer.ts Outdated
@SkyZeroZx

SkyZeroZx commented Jul 31, 2026

Copy link
Copy Markdown
Contributor Author

I feel like this is really a hardening fix. I see little reason to have such a dynamic styles.

Given that it's possible to generate forms with multiple JSON-based properties, adding a style-based customizations (It would suffice for them to be dynamic in any way, in any of the style forms, even if it's a string, that's enough for clobering currently) doesn't seem too strange to me personally, the first condition being somewhat normal at least in some projects I've seen.

As an additional note, a quick search on GitHub suggests that applying style or ngStyle to forms isn't uncommon. The only additional requirement is that those values are dynamic, which is fairly plausible in CMSs, dashboards, or marketplaces.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area: core Issues related to the framework runtime

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Style bindings can write to a clobbered form

2 participants