@angular/core 20.3.16 → 20.3.18

package/api.d.d.ts

@@ -1,5 +1,5 @@
 /**
- * @license Angular v20.3.16
+ * @license Angular v20.3.18
  * (c) 2010-2025 Google LLC. https://angular.dev/
  * License: MIT
  */

package/chrome_dev_tools_performance.d.d.ts

@@ -1,5 +1,5 @@
 /**
- * @license Angular v20.3.16
+ * @license Angular v20.3.18
  * (c) 2010-2025 Google LLC. https://angular.dev/
  * License: MIT
  */

package/discovery.d.d.ts

@@ -1,5 +1,5 @@
 /**
- * @license Angular v20.3.16
+ * @license Angular v20.3.18
  * (c) 2010-2025 Google LLC. https://angular.dev/
  * License: MIT
  */

package/effect.d.d.ts

@@ -1,5 +1,5 @@
 /**
- * @license Angular v20.3.16
+ * @license Angular v20.3.18
  * (c) 2010-2025 Google LLC. https://angular.dev/
  * License: MIT
  */

package/event_dispatcher.d.d.ts

@@ -1,5 +1,5 @@
 /**
- * @license Angular v20.3.16
+ * @license Angular v20.3.18
  * (c) 2010-2025 Google LLC. https://angular.dev/
  * License: MIT
  */

package/fesm2022/attribute.mjs

@@ -1,5 +1,5 @@
 /**
- * @license Angular v20.3.16
+ * @license Angular v20.3.18
  * (c) 2010-2025 Google LLC. https://angular.dev/
  * License: MIT
  */

package/fesm2022/core.mjs

@@ -1,5 +1,5 @@
 /**
- * @license Angular v20.3.16
+ * @license Angular v20.3.18
  * (c) 2010-2025 Google LLC. https://angular.dev/
  * License: MIT
  */

package/fesm2022/debug_node.mjs

@@ -1,5 +1,5 @@
 /**
- * @license Angular v20.3.16
+ * @license Angular v20.3.18
  * (c) 2010-2025 Google LLC. https://angular.dev/
  * License: MIT
  */
@@ -5622,6 +5622,13 @@ const VALID_ATTRS = merge(URI_ATTRS, HTML_ATTRS, ARIA_ATTRS);
 // `Some content`, but strip `invalid-element` opening/closing tags. For some elements, though, we
 // don't want to preserve the content, if the elements themselves are going to be removed.
 const SKIP_TRAVERSING_CONTENT_IF_INVALID_ELEMENTS = tagSet('script,style,template');
+/**
+ * Attributes that are potential attach vectors and may need to be sanitized.
+ */
+const SENSITIVE_ATTRS = merge(URI_ATTRS, 
+// Note: we don't include these attributes in `URI_ATTRS`, because `URI_ATTRS` also
+// determines whether an attribute should be dropped when sanitizing an HTML string.
+tagSet('action,formaction,data,codebase'));
 /**
  * SanitizingHtmlSerializer serializes a DOM fragment, stripping out any unsafe elements and unsafe
  * attributes.
@@ -14720,7 +14727,7 @@ class ComponentFactory extends ComponentFactory$1 {
 }
 function createRootTView(rootSelectorOrNode, componentDef, componentBindings, directives) {
     const tAttributes = rootSelectorOrNode
-        ? ['ng-version', '20.3.16']
+        ? ['ng-version', '20.3.18']
         : // Extract attributes and classes from the first selector only to match VE behavior.
             extractAttrsAndClassesFromSelector(componentDef.selectors[0]);
     let creationBindings = null;
@@ -24917,7 +24924,7 @@ function i18nAttributesFirstPass(tView, index, values) {
                 // the compiler treats static i18n attributes as regular attribute bindings.
                 // Since this may not be the first i18n attribute on this element we need to pass in how
                 // many previous bindings there have already been.
-                generateBindingUpdateOpCodes(updateOpCodes, message, previousElementIndex, attrName, countBindings(updateOpCodes), null);
+                generateBindingUpdateOpCodes(updateOpCodes, message, previousElementIndex, attrName, countBindings(updateOpCodes), SENSITIVE_ATTRS[attrName.toLowerCase()] ? _sanitizeUrl : null);
             }
         }
         tView.data[index] = updateOpCodes;
@@ -25243,15 +25250,9 @@ function walkIcuTree(ast, tView, tIcu, lView, sharedUpdateOpCodes, create, remov
                         const attr = elAttrs.item(i);
                         const lowerAttrName = attr.name.toLowerCase();
                         const hasBinding = !!attr.value.match(BINDING_REGEXP);
-                        // we assume the input string is safe, unless it's using a binding
                         if (hasBinding) {
                             if (VALID_ATTRS.hasOwnProperty(lowerAttrName)) {
-                                if (URI_ATTRS[lowerAttrName]) {
-                                    generateBindingUpdateOpCodes(update, attr.value, newIndex, attr.name, 0, _sanitizeUrl);
-                                }
-                                else {
-                                    generateBindingUpdateOpCodes(update, attr.value, newIndex, attr.name, 0, null);
-                                }
+                                generateBindingUpdateOpCodes(update, attr.value, newIndex, attr.name, 0, SENSITIVE_ATTRS[lowerAttrName] ? _sanitizeUrl : null);
                             }
                             else {
                                 ngDevMode &&
@@ -25260,8 +25261,27 @@ function walkIcuTree(ast, tView, tIcu, lView, sharedUpdateOpCodes, create, remov
                                         `(see ${XSS_SECURITY_URL})`);
                             }
                         }
+                        else if (VALID_ATTRS[lowerAttrName]) {
+                            if (SENSITIVE_ATTRS[lowerAttrName]) {
+                                // Don't sanitize, because no value is acceptable in sensitive attributes.
+                                // Translators are not allowed to create URIs.
+                                if (typeof ngDevMode !== 'undefined' && ngDevMode) {
+                                    console.warn(`WARNING: ignoring unsafe attribute ` +
+                                        `${lowerAttrName} on element ${tagName} ` +
+                                        `(see ${XSS_SECURITY_URL})`);
+                                }
+                                addCreateAttribute(create, newIndex, attr.name, 'unsafe:blocked');
+                            }
+                            else {
+                                addCreateAttribute(create, newIndex, attr.name, attr.value);
+                            }
+                        }
                         else {
-                            addCreateAttribute(create, newIndex, attr);
+                            if (typeof ngDevMode !== 'undefined' && ngDevMode) {
+                                console.warn(`WARNING: ignoring unknown attribute name ` +
+                                    `${lowerAttrName} on element ${tagName} ` +
+                                    `(see ${XSS_SECURITY_URL})`);
+                            }
                         }
                     }
                     const elementNode = {
@@ -25330,8 +25350,8 @@ function addCreateNodeAndAppend(create, marker, text, appendToParentIdx, createA
     }
     create.push(text, createAtIdx, icuCreateOpCode(0 /* IcuCreateOpCode.AppendChild */, appendToParentIdx, createAtIdx));
 }
-function addCreateAttribute(create, newIndex, attr) {
-    create.push((newIndex << 1 /* IcuCreateOpCode.SHIFT_REF */) | 1 /* IcuCreateOpCode.Attr */, attr.name, attr.value);
+function addCreateAttribute(create, newIndex, attrName, attrValue) {
+    create.push((newIndex << 1 /* IcuCreateOpCode.SHIFT_REF */) | 1 /* IcuCreateOpCode.Attr */, attrName, attrValue);
 }
 
 // i18nPostprocess consts