From e82bf679349cdddf3d11911663c390fe792a8549 Mon Sep 17 00:00:00 2001 From: Peter Bacon Darwin Date: Thu, 31 Aug 2017 22:05:18 +0100 Subject: [PATCH] fix(core): use appropriate inert document strategy for Firefox & Safari (#17019) Both Firefox and Safari are vulnerable to XSS if we use an inert document created via `document.implementation.createHTMLDocument()`. Now we check for those vulnerabilities and then use a DOMParser or XHR strategy if needed. Further the platform-server has its own library for parsing HTML, so we sniff for that (by checking whether DOMParser exists) and fall back to the standard strategy. Thanks to @cure53 for the heads up on this issue. PR Close #17019 --- integration/_payload-limits.json | 4 +- .../src/security/html_sanitizer.ts | 116 ++++-------- .../src/security/inert_body.ts | 171 ++++++++++++++++++ .../test/security/html_sanitizer_spec.ts | 41 +++++ 4 files changed, 250 insertions(+), 82 deletions(-) create mode 100644 packages/platform-browser/src/security/inert_body.ts diff --git a/integration/_payload-limits.json b/integration/_payload-limits.json index 3e84588e4d6892..6866a62790af62 100644 --- a/integration/_payload-limits.json +++ b/integration/_payload-limits.json @@ -3,7 +3,7 @@ "master": { "uncompressed": { "inline": 1447, - "main": 151639, + "main": 154185, "polyfills": 59179 } } @@ -11,7 +11,7 @@ "hello_world__closure": { "master": { "uncompressed": { - "bundle": 100661 + "bundle": 101744 } } }, diff --git a/packages/platform-browser/src/security/html_sanitizer.ts b/packages/platform-browser/src/security/html_sanitizer.ts index 07fb7c8adef780..fd49067b425890 100644 --- a/packages/platform-browser/src/security/html_sanitizer.ts +++ b/packages/platform-browser/src/security/html_sanitizer.ts @@ -10,35 +10,9 @@ import {isDevMode} from '@angular/core'; import {DomAdapter, getDOM} from '../dom/dom_adapter'; +import {InertBodyHelper} from './inert_body'; import {sanitizeSrcset, sanitizeUrl} from './url_sanitizer'; -/** A element that can be safely used to parse untrusted HTML. Lazily initialized below. */ -let inertElement: HTMLElement|null = null; -/** Lazily initialized to make sure the DOM adapter gets set before use. */ -let DOM: DomAdapter = null !; - -/** Returns an HTML element that is guaranteed to not execute code when creating elements in it. */ -function getInertElement() { - if (inertElement) return inertElement; - DOM = getDOM(); - - // Prefer using