fix(@angular/ssr): validate decoded x-forwarded-prefix before prefix checks#32814
fix(@angular/ssr): validate decoded x-forwarded-prefix before prefix checks#32814artahir-dev wants to merge 1 commit intoangular:mainfrom
Conversation
|
Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA). View this failed invocation of the CLA check for more information. For the most up to date status, view the checks section at the bottom of the pull request. |
There was a problem hiding this comment.
Code Review
This pull request addresses a security vulnerability by ensuring the x-forwarded-prefix header is URL-decoded before validation checks are applied. This prevents potential bypasses using percent-encoded characters. The change is implemented correctly in packages/angular/ssr/src/utils/validation.ts, including proper error handling for malformed encoding. The accompanying tests in packages/angular/ssr/test/utils/validation_spec.ts are thorough, covering both encoded bypass attempts and invalid encoding sequences. The changes look good and effectively mitigate the described issue.
|
@alan-agius4 @securityMB @josephperrott @AndrewKushnir @dgp1130 Closing this pull request as the issue has been reported through the appropriate private disclosure channel. Tracked here: Further coordination will continue there to ensure proper handling and responsible disclosure. Thank you. |
PR Checklist
Please check to confirm your PR fulfills the following requirements:
PR Type
What kind of change does this PR introduce?
What is the current behavior?
X-Forwarded-Prefixis validated before decoding. In practice that means encoded unsafe values can pass the regex check and only become unsafe later when decoded in SSR URL handling.Issue Number: N/A
What is the new behavior?
X-Forwarded-Prefixis decoded first during validation. If decoding fails, request validation now returns a clear error for invalid percent-encoding. The existing prefix safety checks are then applied to the decoded value.Regression tests were added to cover encoded bypass attempts and malformed encoded prefixes.
Does this PR introduce a breaking change?
Other information
This change is intentionally scoped to header validation only.