GeezerVison

The World Wide Web, restored to 800 pixels of glory.

GeezerVison is showing github.com — fix(zone.js): validate __Zone_symbol_prefix to prevent DOM clobbering… · angular/angular@e50f504

File tree

Expand file treeCollapse file tree

Open diff view settings

Filter options

packages/zone.js/lib
- zone-impl.ts

Expand file treeCollapse file tree

Open diff view settings

Collapse file

`‎packages/zone.js/lib/zone-impl.ts‎`

Copy file name to clipboardExpand all lines: packages/zone.js/lib/zone-impl.ts

+5-3Lines changed: 5 additions & 3 deletions

Original file line number	Diff line number	Diff line change
`@@ -762,10 +762,12 @@ export type AmbientZone = Zone;`
`762`	`762`
`763`	`763`	`const global = globalThis as any;`
`764`	`764`
`765`		`-// __Zone_symbol_prefix global can be used to override the default zone`
`766`		`-// symbol prefix with a custom one if needed.`
	`765`	`+// __Zone_symbol_prefix can be set globally to override the default zone symbol prefix.`
`767`	`766`	`export function __symbol__(name: string) {`
`768`		`- const symbolPrefix = global['__Zone_symbol_prefix'] \|\| '__zone_symbol__';`
	`767`	`+ const rawPrefix = global['__Zone_symbol_prefix'];`
	`768`	`+ // Guard against DOM clobbering: an attacker can set __Zone_symbol_prefix to an HTMLElement`
	`769`	`+ // via e.g. <input name="__Zone_symbol_prefix">, so we only trust it if it's actually a string.`
	`770`	`+ const symbolPrefix = typeof rawPrefix === 'string' ? rawPrefix : '__zone_symbol__';`
`769`	`771`	`return symbolPrefix + name;`
`770`	`772`	`}`
`771`	`773`

0 commit comments

Comments

0 (0)

You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.