@angular-helpers/security 21.4.2 → 21.4.3

package/fesm2022/angular-helpers-security.mjs

@@ -922,6 +922,7 @@ const DEFAULT_ALLOWED_TAGS = [
 const DEFAULT_ALLOWED_ATTRIBUTES = {
     a: ['href'],
 };
+const URL_ATTRIBUTES = new Set(['href', 'src', 'action', 'formaction', 'data', 'poster']);
 /**
  * Sanitizes an HTML string by allowlist. Browser-only: requires DOMParser.
  *
@@ -980,7 +981,7 @@ function sanitizeElementAttributes(element, tagName, allowedAttributes) {
             attrsToRemove.push(attr.name);
             continue;
         }
-        if (attr.name === 'href' && sanitizeUrlString(attr.value) === null) {
+        if (URL_ATTRIBUTES.has(attr.name) && sanitizeUrlString(attr.value) === null) {
             attrsToRemove.push(attr.name);
         }
     }
@@ -1512,13 +1513,23 @@ class RateLimiterService {
                 this.configure(key, policy);
             }
         }
-        this.destroyRef.onDestroy(() => this.buckets.clear());
+        this.destroyRef.onDestroy(() => {
+            for (const bucket of this.buckets.values()) {
+                if (bucket.timerId)
+                    clearTimeout(bucket.timerId);
+            }
+            this.buckets.clear();
+        });
     }
     /**
      * Registers or updates the policy for `key`. Re-configuring an existing key resets its state.
      */
     configure(key, policy) {
         validatePolicy(policy);
+        const existing = this.buckets.get(key);
+        if (existing && existing.timerId) {
+            clearTimeout(existing.timerId);
+        }
         const now = Date.now();
         const initialRemaining = policy.type === 'token-bucket' ? policy.capacity : policy.max;
         this.buckets.set(key, {
@@ -1553,6 +1564,7 @@ class RateLimiterService {
             }
             bucket.tokens -= tokens;
             bucket.remaining.set(Math.floor(bucket.tokens));
+            this.scheduleAutoRefill(key, bucket);
             return;
         }
         // sliding-window
@@ -1566,6 +1578,7 @@ class RateLimiterService {
         for (let i = 0; i < tokens; i++)
             bucket.timestamps.push(now);
         bucket.remaining.set(bucket.policy.max - bucket.timestamps.length);
+        this.scheduleAutoRefill(key, bucket);
     }
     /**
      * Reactive signal indicating whether a single unit can be consumed from `key` right now.
@@ -1594,6 +1607,10 @@ class RateLimiterService {
         const bucket = this.buckets.get(key);
         if (!bucket)
             return;
+        if (bucket.timerId) {
+            clearTimeout(bucket.timerId);
+            bucket.timerId = undefined;
+        }
         bucket.timestamps = [];
         if (bucket.policy.type === 'token-bucket') {
             bucket.tokens = bucket.policy.capacity;
@@ -1615,6 +1632,41 @@ class RateLimiterService {
         bucket.lastRefillAt = now;
         bucket.remaining.set(Math.floor(bucket.tokens));
     }
+    scheduleAutoRefill(key, bucket) {
+        if (bucket.timerId) {
+            clearTimeout(bucket.timerId);
+            bucket.timerId = undefined;
+        }
+        const now = Date.now();
+        if (bucket.policy.type === 'token-bucket') {
+            if (bucket.tokens >= bucket.policy.capacity) {
+                return;
+            }
+            const currentFloor = Math.floor(bucket.tokens);
+            const nextInteger = currentFloor + 1;
+            const deficit = nextInteger - bucket.tokens;
+            const timeToNextTokenMs = Math.max(10, Math.ceil((deficit / bucket.policy.refillPerSecond) * 1000));
+            bucket.timerId = setTimeout(() => {
+                const tNow = Date.now();
+                this.refillTokenBucket(bucket, tNow);
+                this.scheduleAutoRefill(key, bucket);
+            }, timeToNextTokenMs);
+        }
+        else {
+            // sliding-window
+            const windowStart = now - bucket.policy.windowMs;
+            bucket.timestamps = bucket.timestamps.filter((t) => t > windowStart);
+            bucket.remaining.set(bucket.policy.max - bucket.timestamps.length);
+            if (bucket.timestamps.length === 0) {
+                return;
+            }
+            const oldest = bucket.timestamps[0];
+            const timeToExpiryMs = Math.max(10, oldest + bucket.policy.windowMs - now);
+            bucket.timerId = setTimeout(() => {
+                this.scheduleAutoRefill(key, bucket);
+            }, timeToExpiryMs);
+        }
+    }
     static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "21.2.13", ngImport: i0, type: RateLimiterService, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
     static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "21.2.13", ngImport: i0, type: RateLimiterService });
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@angular-helpers/security",
-  "version": "21.4.2",
+  "version": "21.4.3",
   "description": "Angular security helpers for preventing ReDoS and other security vulnerabilities",
   "keywords": [
     "angular",

package/types/angular-helpers-security.d.ts

@@ -675,6 +675,7 @@ declare class RateLimiterService {
      */
     reset(key: string): void;
     private refillTokenBucket;
+    private scheduleAutoRefill;
     static ɵfac: i0.ɵɵFactoryDeclaration<RateLimiterService, never>;
     static ɵprov: i0.ɵɵInjectableDeclaration<RateLimiterService>;
 }