fix(core): validate lowercase SVG animation attribute names#69161
Conversation
SkyZeroZx
force-pushed
the
fix/atributename-ssr
branch
from
69bff06 to
4535194
Compare
alan-agius4
left a comment
alan-agius4
left a comment
There was a problem hiding this comment.
We should resolve this issue in Domino to maintain consistent casing behavior, given that the browser ignores case sensitivity in this context.
I'll open a PR on Domino. |
|
PR in domino angular/domino#31 |
There was a problem hiding this comment.
I did some further investigation into this morning's issue regarding the case-insensitivity of attributeName.
It appears the attribute is case-sensitive. Executing element.setAttribute('attributeName') versus its lowercase counterpart creates two distinct attributes on the element, with the lowercase version failing to trigger the intended behavior.
Now, the problem is that the browser tokenizer, on initial parsing will normalize attributename to attributeName and thus triggering the sanitizer on the client.
Overall, Domino is doing the right thing here, attributes for SVG are case sensitive when using the JS APIs, for the extra security let's go with this change instead.
alan-agius4
left a comment
alan-agius4
left a comment
There was a problem hiding this comment.
Reviewed-for: fw-security
alan-agius4
added
action: review
Normalize SVG animation attributeName lookup to also recognize lowercase attributename before allowing dynamic animation value bindings. Add runtime and platform-server SSR regression coverage for lowercase attributename retargeting.
SkyZeroZx
force-pushed
the
fix/atributename-ssr
branch
from
4535194 to
d5e689a
Compare
josephperrott
left a comment
josephperrott
left a comment
There was a problem hiding this comment.
LGTM
Reviewed-for: fw-security
alan-agius4
added
action: merge
5 participants
Normalize SVG animation attributeName lookup to also recognize lowercase attributename before allowing dynamic animation value bindings.
Add runtime and platform-server SSR regression coverage for lowercase attributename retargeting.
This would be similar to GHSA-jrmj-c5cx-3cw6
This only happens in SSR mode, which, despite throwing an exception on the client, doesn't actually sanitize/render the element.