[14.2.x] fix(core): hardening attribute and property binding rules for <iframe> elements #48028

AndrewKushnir · 2022-11-11T01:05:11Z

This commit updates the logic related to the attribute and property binding rules for <iframe> elements. There is a set of <iframe> attributes that may affect the behavior of an iframe and this change enforces that these attributes are only applied as static attributes, making sure that they are taken into account while creating an <iframe>.

If Angular detects that some of the security-sensitive attributes are applied as an attribute or property binding, it throws an error message, which contains the name of an attribute that is causing the problem and the name of a Component where an iframe is located.

BREAKING CHANGE:

Existing iframe usages may have security-sensitive attributes applied as an attribute or property binding in a template or via host bindings in a directive. Such usages would require an update to ensure compliance with the new stricter rules around iframe bindings.

PR Type

What kind of change does this PR introduce?

Bugfix

…> elements This commit updates the logic related to the attribute and property binding rules for <iframe> elements. There is a set of <iframe> attributes that may affect the behavior of an iframe and this change enforces that these attributes are only applied as static attributes, making sure that they are taken into account while creating an <iframe>. If Angular detects that some of the security-sensitive attributes are applied as an attribute or property binding, it throws an error message, which contains the name of an attribute that is causing the problem and the name of a Component where an iframe is located. BREAKING CHANGE: Existing iframe usages may have security-sensitive attributes applied as an attribute or property binding in a template or via host bindings in a directive. Such usages would require an update to ensure compliance with the new stricter rules around iframe bindings.

AndrewKushnir · 2022-11-12T00:10:45Z

Caretaker note: FYI this PR is a cherry-pick of a couple commits that we've landed in the main and 15.0.x branches. No changes were made to the fix itself, I had to drop a couple tests that covered host directives, which are not supported in v14 (only starting from v15).

Also, since this is a patch-only PR, no presubmits are needed.

dylhunn · 2022-11-21T20:19:56Z

This PR was merged into the repository by commit 244a7d2.

…> elements (#48028) This commit updates the logic related to the attribute and property binding rules for <iframe> elements. There is a set of <iframe> attributes that may affect the behavior of an iframe and this change enforces that these attributes are only applied as static attributes, making sure that they are taken into account while creating an <iframe>. If Angular detects that some of the security-sensitive attributes are applied as an attribute or property binding, it throws an error message, which contains the name of an attribute that is causing the problem and the name of a Component where an iframe is located. BREAKING CHANGE: Existing iframe usages may have security-sensitive attributes applied as an attribute or property binding in a template or via host bindings in a directive. Such usages would require an update to ensure compliance with the new stricter rules around iframe bindings. PR Close #48028

…48028) PR Close #48028

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [@angular/animations](https://github.com/angular/angular) | dependencies | patch | [`14.2.11` -> `14.2.12`](https://renovatebot.com/diffs/npm/@angular%2fanimations/14.2.11/14.2.12) | | [@angular/common](https://github.com/angular/angular) | dependencies | patch | [`14.2.11` -> `14.2.12`](https://renovatebot.com/diffs/npm/@angular%2fcommon/14.2.11/14.2.12) | | [@angular/compiler](https://github.com/angular/angular) | dependencies | patch | [`14.2.11` -> `14.2.12`](https://renovatebot.com/diffs/npm/@angular%2fcompiler/14.2.11/14.2.12) | | [@angular/compiler-cli](https://github.com/angular/angular/tree/main/packages/compiler-cli) ([source](https://github.com/angular/angular)) | devDependencies | patch | [`14.2.11` -> `14.2.12`](https://renovatebot.com/diffs/npm/@angular%2fcompiler-cli/14.2.11/14.2.12) | | [@angular/core](https://github.com/angular/angular) | dependencies | patch | [`14.2.11` -> `14.2.12`](https://renovatebot.com/diffs/npm/@angular%2fcore/14.2.11/14.2.12) | | [@angular/forms](https://github.com/angular/angular) | dependencies | patch | [`14.2.11` -> `14.2.12`](https://renovatebot.com/diffs/npm/@angular%2fforms/14.2.11/14.2.12) | | [@angular/platform-browser](https://github.com/angular/angular) | dependencies | patch | [`14.2.11` -> `14.2.12`](https://renovatebot.com/diffs/npm/@angular%2fplatform-browser/14.2.11/14.2.12) | | [@angular/platform-browser-dynamic](https://github.com/angular/angular) | dependencies | patch | [`14.2.11` -> `14.2.12`](https://renovatebot.com/diffs/npm/@angular%2fplatform-browser-dynamic/14.2.11/14.2.12) | --- ### Release Notes <details> <summary>angular/angular</summary> ### [`v14.2.12`](https://github.com/angular/angular/blob/HEAD/CHANGELOG.md#14212-2022-11-21) [Compare Source](angular/angular@14.2.11...14.2.12) #### Breaking Changes ##### core - Existing iframe usages may have security-sensitive attributes applied as an attribute or property binding in a template or via host bindings in a directive. Such usages would require an update to ensure compliance with the new stricter rules around iframe bindings. ##### core | Commit | Type | Description | | -- | -- | -- | | [54814c8e9b](angular/angular@54814c8) | fix | hardening attribute and property binding rules for <iframe> elements ([#48028](angular/angular#48028)) | #### Special Thanks Andrew Kushnir  </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).  Co-authored-by: cabr2-bot <cabr2.help@gmail.com> Reviewed-on: https://codeberg.org/Calciumdibromid/CaBr2/pulls/1653 Reviewed-by: Epsilon_02 <epsilon_02@noreply.codeberg.org> Co-authored-by: Calciumdibromid Bot <cabr2_bot@noreply.codeberg.org> Co-committed-by: Calciumdibromid Bot <cabr2_bot@noreply.codeberg.org>

angular-automatic-lock-bot · 2022-12-22T16:06:18Z

This issue has been automatically locked due to inactivity.
Please file a new issue if you are encountering a similar or related problem.

Read more about our automatic conversation locking policy.

_{This action has been performed automatically by a bot.}

AndrewKushnir added area: core Issues related to the framework runtime target: patch This PR is targeted for the next patch release PullApprove: disable labels Nov 11, 2022

AndrewKushnir requested a review from alxhub November 11, 2022 01:05

ngbot bot modified the milestone: Backlog Nov 11, 2022

angular-robot bot added the flag: breaking change label Nov 11, 2022

AndrewKushnir changed the title ~~fix(core): hardening attribute and property binding rules for <iframe> elements~~ [14.2.x] fix(core): hardening attribute and property binding rules for <iframe> elements Nov 11, 2022

AndrewKushnir force-pushed the backport_47964_to_14_2_x branch from 1f013ee to a5acb16 Compare November 11, 2022 01:58

AndrewKushnir added 2 commits November 11, 2022 15:59

docs(core): add an error details page for unsafe <iframe> bindings

26ccc89

AndrewKushnir force-pushed the backport_47964_to_14_2_x branch from a5acb16 to 26ccc89 Compare November 12, 2022 00:08

AndrewKushnir added merge: caretaker note Alert the caretaker performing the merge to check the PR for an out of normal action needed or note action: merge The PR is ready for merge by the caretaker and removed action: merge The PR is ready for merge by the caretaker labels Nov 12, 2022

josephperrott added detected: breaking change PR contains a commit with a breaking change and removed flag: breaking change labels Nov 14, 2022

alxhub approved these changes Nov 17, 2022

View reviewed changes

dylhunn added the action: merge The PR is ready for merge by the caretaker label Nov 21, 2022

AndrewKushnir added target: lts This PR is targeting a version currently in long-term support and removed target: patch This PR is targeted for the next patch release labels Nov 21, 2022

dylhunn pushed a commit that referenced this pull request Nov 21, 2022

docs(core): add an error details page for unsafe <iframe> bindings (#…

244a7d2

…48028) PR Close #48028

dylhunn closed this Nov 21, 2022

angular-automatic-lock-bot bot locked and limited conversation to collaborators Dec 22, 2022

[14.2.x] fix(core): hardening attribute and property binding rules for <iframe> elements #48028

[14.2.x] fix(core): hardening attribute and property binding rules for <iframe> elements #48028

AndrewKushnir commented Nov 11, 2022

AndrewKushnir commented Nov 12, 2022 •

edited

dylhunn commented Nov 21, 2022

angular-automatic-lock-bot bot commented Dec 22, 2022

[14.2.x] fix(core): hardening attribute and property binding rules for <iframe> elements #48028

[14.2.x] fix(core): hardening attribute and property binding rules for <iframe> elements #48028

Conversation

AndrewKushnir commented Nov 11, 2022

PR Type

AndrewKushnir commented Nov 12, 2022 • edited

dylhunn commented Nov 21, 2022

angular-automatic-lock-bot bot commented Dec 22, 2022

AndrewKushnir commented Nov 12, 2022 •

edited