@angular/language-service 9.1.12 → 9.1.13

package/bundles/language-service.umd.js

@@ -1,5 +1,5 @@
 /**
- * @license Angular v9.1.12
+ * @license Angular v9.1.13
  * Copyright Google Inc. All Rights Reserved.
  * License: MIT
  */
@@ -19601,7 +19601,7 @@ define(['exports', 'typescript/lib/tsserverlibrary', 'typescript', 'path'], func
      * Use of this source code is governed by an MIT-style license that can be
      * found in the LICENSE file at https://angular.io/license
      */
-    var VERSION$1 = new Version('9.1.12');
+    var VERSION$1 = new Version('9.1.13');
 
     /**
      * @license
@@ -33620,6 +33620,42 @@ define(['exports', 'typescript/lib/tsserverlibrary', 'typescript', 'path'], func
         SecurityContext[SecurityContext["RESOURCE_URL"] = 5] = "RESOURCE_URL";
     })(SecurityContext$1 || (SecurityContext$1 = {}));
 
+    /**
+     * @license
+     * Copyright Google Inc. All Rights Reserved.
+     *
+     * Use of this source code is governed by an MIT-style license that can be
+     * found in the LICENSE file at https://angular.io/license
+     */
+    var END_COMMENT = /-->/g;
+    var END_COMMENT_ESCAPED = '-\u200B-\u200B>';
+    /**
+     * Escape the content of the strings so that it can be safely inserted into a comment node.
+     *
+     * The issue is that HTML does not specify any way to escape comment end text inside the comment.
+     * `<!-- The way you close a comment is with "-->". -->`. Above the `"-->"` is meant to be text not
+     * an end to the comment. This can be created programmatically through DOM APIs.
+     *
+     * ```
+     * div.innerHTML = div.innerHTML
+     * ```
+     *
+     * One would expect that the above code would be safe to do, but it turns out that because comment
+     * text is not escaped, the comment may contain text which will prematurely close the comment
+     * opening up the application for XSS attack. (In SSR we programmatically create comment nodes which
+     * may contain such text and expect them to be safe.)
+     *
+     * This function escapes the comment text by looking for the closing char sequence `-->` and replace
+     * it with `-_-_>` where the `_` is a zero width space `\u200B`. The result is that if a comment
+     * contains `-->` text it will render normally but it will not cause the HTML parser to close the
+     * comment.
+     *
+     * @param value text to make safe for comment node by escaping the comment close character sequence
+     */
+    function escapeCommentText(value) {
+        return value.replace(END_COMMENT, END_COMMENT_ESCAPED);
+    }
+
     /**
      * @license
      * Copyright Google Inc. All Rights Reserved.
@@ -40127,7 +40163,7 @@ define(['exports', 'typescript/lib/tsserverlibrary', 'typescript', 'path'], func
     /**
      * @publicApi
      */
-    var VERSION$2 = new Version$1('9.1.12');
+    var VERSION$2 = new Version$1('9.1.13');
 
     /**
      * @license
@@ -49271,7 +49307,7 @@ define(['exports', 'typescript/lib/tsserverlibrary', 'typescript', 'path'], func
                 var el = asElementData(view, elDef.nodeIndex).renderElement;
                 if (!elDef.element.name) {
                     // a comment.
-                    view.renderer.setValue(el, "bindings=" + JSON.stringify(bindingValues, null, 2));
+                    view.renderer.setValue(el, escapeCommentText("bindings=" + JSON.stringify(bindingValues, null, 2)));
                 }
                 else {
                     // a regular element.
@@ -49560,7 +49596,7 @@ define(['exports', 'typescript/lib/tsserverlibrary', 'typescript', 'path'], func
             return el;
         };
         DebugRenderer2.prototype.createComment = function (value) {
-            var comment = this.delegate.createComment(value);
+            var comment = this.delegate.createComment(escapeCommentText(value));
             var debugCtx = this.createDebugContext(comment);
             if (debugCtx) {
                 indexDebugNode(new DebugNode__PRE_R3__(comment, null, debugCtx));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@angular/language-service",
-  "version": "9.1.12",
+  "version": "9.1.13",
   "description": "Angular - language services",
   "main": "./bundles/language-service.umd.js",
   "module": "./fesm5/language-service.js",