Angular Two-Way Property Binding Sanitization Bypass Vulnerability

Vulnerability Overview This vulnerability concerns a security issue with two-way property bindings in the Angular framework. Specifically, when two-way property bindings are used, Angular incorrectly applies the same sanitization logic used for one-way property bindings, which may lead to potential security risks. Impact Scope Affected Versions: Angular v22.1.0-next.3 and earlier. Impact Scenario: When using two-way property bindings, if the bound value contains malicious content, it may result in a security vulnerability. Remediation 1. Code Changes: - Modified to adjust the sanitization logic for two-way property bindings. - Modified to add specific sanitization handling for two-way property bindings. - Modified to add corresponding test cases. - Modified to add sanitization handling for two-way property bindings. 2. Specific Code Changes: - In , the sanitization logic for two-way property bindings was adjusted to ensure it is consistent with the sanitization logic applied to one-way property bindings. - In , specific sanitization handling was added for two-way property bindings to ensure the sanitization logic is applied correctly. - In , corresponding test cases were added to verify that the fixed logic works correctly. - In , sanitization handling was added for two-way property bindings to ensure the sanitization logic is applied correctly. POC Code `` ` }) export class MyComponent { evil: string = 'alert("XSS")'; } // core/src/template/pipeline/src/phases/resolve_sanitizers.ts export function resolveSanitizers(job: CompilationJob): void { case ir.OpKind.Attribute: case ir.OpKind.Property: case ir.OpKind.TwoWayProperty: let sanitizerFn: o.ExternalReference if (Array.isArray(op.securityContext) && op.securityContext.includes(ir.SecurityContext.SANITIZE_HTML)) { sanitizerFn = sanitizerFn } if (Array.isArray(op.securityContext) && op.securityContext.includes(ir.SecurityContext.SANITIZE_STYLE)) { sanitizerFn = sanitizerFn } if (Array.isArray(op.securityContext) && op.securityContext.includes(ir.SecurityContext.SANITIZE_URL)) { sanitizerFn = sanitizerFn } if (Array.isArray(op.securityContext) && op.securityContext.includes(ir.SecurityContext.SANITIZE_RESOURCE_URL)) { sanitizerFn = sanitizerFn } if (Array.isArray(op.securityContext) && op.securityContext.includes(ir.SecurityContext.SANITIZE_SCRIPT)) { sanitizerFn = sanitizerFn } if (Array.isArray(op.securityContext) && op.securityContext.includes(ir.SecurityContext.SANITIZE_STYLE)) { sanitizerFn = sanitizerFn } if (Array.isArray(op.securityContext) && op.securityContext.includes(ir.SecurityContext.SANITIZE_URL)) { sanitizerFn = sanitizerFn } if (Array.isArray(op.securityContext) && op.securityContext.includes(ir.SecurityContext.SANITIZE_RESOURCE_URL)) { sanitizerFn = sanitizerFn } if (Array.isArray(op.securityContext) && op.securityContext.includes(ir.SecurityContext.SANITIZE_SCRIPT)) { sanitizerFn = sanitizerFn } if (Array.isArray(op.securityContext) && op.securityContext.includes(ir.SecurityContext.SANITIZE_STYLE)) { sanitizerFn = sanitizerFn } if (Array.isArray(op.securityContext) && op.securityContext.includes(ir.SecurityContext.SANITIZE_URL)) { sanitizerFn = sanitizerFn } if (Array.isArray(op.securityContext) && op.securityContext.includes(ir.SecurityContext.SANITIZE_RESOURCE_URL)) { sanitizerFn = sanitizerFn } if (Array.isArray(op.securityContext) && op.securityContext.includes(ir.SecurityContext.SANITIZE_SCRIPT)) { sanitizerFn = sanitizerFn } if (Array.isArray(op.securityContext) && op.securityContext.includes(ir.SecurityContext.SANITIZE_STYLE)) { sanitizerFn = sanitizerFn } if (Array.isArray(op.securityContext) && op.securityContext.includes(ir.SecurityContext.SANITIZE_URL)) { sanitizerFn = sanitizerFn } if (Array.isArray(op.securityContext) && op.securityContext.includes(ir.SecurityContext.SANITIZE_RESOURCE_URL)) { sanitizerFn = sanitizerFn } if (Array.isArray(op.securityContext) && op.securityContext.includes(ir.SecurityContext.SANITIZE_SCRIPT)) { sanitizerFn = sanitizerFn } if (Array.isArray(op.securityContext) && op.securityContext.includes(ir.SecurityContext.SANITIZE_STYLE)) { sanitizerFn = sanitizerFn } if (Array.isArray(op.securityContext) && op.securityContext.includes(ir.SecurityContext.SANITIZE_URL)) { sanitizerFn = sanitizerFn } if (Array.isArray(op.securityContext) && op.securityContext.includes(ir.SecurityContext.SANITIZE_RESOURCE_URL)) { sanitizerFn = sanitizerFn } if (Array.isArray(op.securityContext) && op.securityContext.includes(ir.SecurityContext.SANITIZE_SCRIPT)) { sanitizerFn = sanitizerFn } if (Array.isArray(op.securityContext) && op.securityContext.includes(ir.SecurityContext.SANITIZE_STYLE)) { sanitizerFn = sanitizerFn } if (Array.isArray(op.securityContext) && op.securityContext.includes(ir.SecurityContext.SANITIZE_URL)) { sanitizerFn = sanitizerFn } if (Array.isArray(op.securityContext) && op.securityContext.includes(ir.SecurityContext.SANITIZE_RESOURCE_URL)) { sanitizerFn = sanitizerFn } if (Array.isArray(op.securityContext

Goal Reached Thanks to every supporter — we hit 100%!

Angular Two-Way Property Binding Sanitization Bypass Vulnerability

More from this source