@angular/ssr 20.3.24 → 20.3.26

package/fesm2022/validation.mjs

@@ -1,7 +1,17 @@
+/**
+ * Common X-Forwarded-* headers.
+ */
+const X_FORWARDED_HEADERS = new Set([
+    'x-forwarded-for',
+    'x-forwarded-host',
+    'x-forwarded-port',
+    'x-forwarded-proto',
+    'x-forwarded-prefix',
+]);
 /**
  * The set of headers that should be validated for host header injection attacks.
  */
-const HOST_HEADERS_TO_VALIDATE = new Set(['host', 'x-forwarded-host']);
+const HOST_HEADERS_TO_VALIDATE = ['host', 'x-forwarded-host'];
 /**
  * Regular expression to validate that the port is a numeric value.
  */
@@ -10,14 +20,10 @@ const VALID_PORT_REGEX = /^\d+$/;
  * Regular expression to validate that the protocol is either http or https (case-insensitive).
  */
 const VALID_PROTO_REGEX = /^https?$/i;
-/**
- * Regular expression to validate that the host is a valid hostname.
- */
-const VALID_HOST_REGEX = /^[a-z0-9.:-]+$/i;
 /**
  * Regular expression to validate that the prefix is valid.
  */
-const INVALID_PREFIX_REGEX = /^(?:\\|\/[/\\])|(?:^|[/\\])\.\.?(?:[/\\]|$)/;
+const VALID_PREFIX_REGEX = /^\/([a-z0-9_-]+\/)*[a-z0-9_-]*$/i;
 /**
  * Extracts the first value from a multi-value header string.
  *
@@ -42,9 +48,11 @@ function getFirstHeaderValue(value) {
  * @param allowedHosts - A set of allowed hostnames.
  * @throws Error if any of the validated headers contain invalid values.
  */
-function validateRequest(request, allowedHosts) {
-    validateHeaders(request);
-    validateUrl(new URL(request.url), allowedHosts);
+function validateRequest(request, allowedHosts, disableHostCheck) {
+    validateHeaders(request, allowedHosts, disableHostCheck);
+    if (!disableHostCheck) {
+        validateUrl(new URL(request.url), allowedHosts);
+    }
 }
 /**
  * Validates that the hostname of a given URL is allowed.
@@ -60,83 +68,37 @@ function validateUrl(url, allowedHosts) {
     }
 }
 /**
- * Clones a request and patches the `get` method of the request headers to validate the host headers.
- * @param request - The request to validate.
- * @param allowedHosts - A set of allowed hostnames.
- * @returns An object containing the cloned request and a promise that resolves to an error
- * if any of the validated headers contain invalid values.
+ * Sanitizes the proxy headers of a request by removing unallowed `X-Forwarded-*` headers.
+ * If no headers need to be removed, the original request is returned without cloning.
+ *
+ * @param request - The incoming `Request` object to sanitize.
+ * @param trustProxyHeaders - A set of allowed proxy headers.
+ * @returns An object containing the sanitized request, or the original request if no changes were needed.
  */
-function cloneRequestAndPatchHeaders(request, allowedHosts) {
-    let onError;
-    const onErrorPromise = new Promise((resolve) => {
-        onError = resolve;
-    });
+function sanitizeRequestHeaders(request, trustProxyHeaders) {
+    const keysToDelete = [];
+    let deoptToCSR = false;
+    for (const [key] of request.headers) {
+        const lowerKey = key.toLowerCase();
+        if (lowerKey.startsWith('x-forwarded-') && !isProxyHeaderAllowed(lowerKey, trustProxyHeaders)) {
+            // eslint-disable-next-line no-console
+            console.warn(`Received "${key}" header but "trustProxyHeaders" was not set up to allow it.\n` +
+                `For more information, see https://angular.dev/best-practices/security#configuring-trusted-proxy-headers`);
+            deoptToCSR = true;
+            keysToDelete.push(key);
+        }
+    }
+    if (keysToDelete.length === 0) {
+        return { request, deoptToCSR };
+    }
     const clonedReq = new Request(request.clone(), {
         signal: request.signal,
     });
     const headers = clonedReq.headers;
-    const originalGet = headers.get;
-    // eslint-disable-next-line @typescript-eslint/no-unnecessary-type-assertion
-    headers.get = function (name) {
-        const value = originalGet.call(headers, name);
-        if (!value) {
-            return value;
-        }
-        validateHeader(name, value, allowedHosts, onError);
-        return value;
-    };
-    const originalValues = headers.values;
-    // eslint-disable-next-line @typescript-eslint/no-unnecessary-type-assertion
-    headers.values = function () {
-        for (const name of HOST_HEADERS_TO_VALIDATE) {
-            validateHeader(name, originalGet.call(headers, name), allowedHosts, onError);
-        }
-        return originalValues.call(headers);
-    };
-    const originalEntries = headers.entries;
-    // eslint-disable-next-line @typescript-eslint/no-unnecessary-type-assertion
-    headers.entries = function () {
-        const iterator = originalEntries.call(headers);
-        return {
-            next() {
-                const result = iterator.next();
-                if (!result.done) {
-                    const [key, value] = result.value;
-                    validateHeader(key, value, allowedHosts, onError);
-                }
-                return result;
-            },
-            [Symbol.iterator]() {
-                return this;
-            },
-        };
-    };
-    // Ensure for...of loops use the new patched entries
-    headers[Symbol.iterator] = headers.entries;
-    return { request: clonedReq, onError: onErrorPromise };
-}
-/**
- * Validates a specific header value against the allowed hosts.
- * @param name - The name of the header to validate.
- * @param value - The value of the header to validate.
- * @param allowedHosts - A set of allowed hostnames.
- * @param onError - A callback function to call if the header value is invalid.
- * @throws Error if the header value is invalid.
- */
-function validateHeader(name, value, allowedHosts, onError) {
-    if (!value) {
-        return;
-    }
-    if (!HOST_HEADERS_TO_VALIDATE.has(name.toLowerCase())) {
-        return;
-    }
-    try {
-        verifyHostAllowed(name, value, allowedHosts);
-    }
-    catch (error) {
-        onError(error);
-        throw error;
+    for (const key of keysToDelete) {
+        headers.delete(key);
     }
+    return { request: clonedReq, deoptToCSR };
 }
 /**
  * Validates a specific host header value against the allowed hosts.
@@ -147,17 +109,16 @@ function validateHeader(name, value, allowedHosts, onError) {
  * @throws Error if the header value is invalid or the hostname is not in the allowlist.
  */
 function verifyHostAllowed(headerName, headerValue, allowedHosts) {
-    const value = getFirstHeaderValue(headerValue);
-    if (!value) {
-        return;
-    }
-    const url = `http://${value}`;
+    const url = `http://${headerValue}`;
     if (!URL.canParse(url)) {
         throw new Error(`Header "${headerName}" contains an invalid value and cannot be parsed.`);
     }
-    const { hostname } = new URL(url);
+    const { hostname, pathname, search, hash, username, password } = new URL(url);
+    if (pathname !== '/' || search || hash || username || password) {
+        throw new Error(`Header "${headerName}" with value "${headerValue}" contains characters that are not allowed.`);
+    }
     if (!isHostAllowed(hostname, allowedHosts)) {
-        throw new Error(`Header "${headerName}" with value "${value}" is not allowed.`);
+        throw new Error(`Header "${headerName}" with value "${headerValue}" is not allowed.`);
     }
 }
 /**
@@ -185,14 +146,16 @@ function isHostAllowed(hostname, allowedHosts) {
  * Validates the headers of an incoming request.
  *
  * @param request - The incoming `Request` object containing the headers to validate.
+ * @param allowedHosts - A set of allowed hostnames.
+ * @param disableHostCheck - Whether to disable the host check.
  * @throws Error if any of the validated headers contain invalid values.
  */
-function validateHeaders(request) {
+function validateHeaders(request, allowedHosts, disableHostCheck) {
     const headers = request.headers;
     for (const headerName of HOST_HEADERS_TO_VALIDATE) {
         const headerValue = getFirstHeaderValue(headers.get(headerName));
-        if (headerValue && !VALID_HOST_REGEX.test(headerValue)) {
-            throw new Error(`Header "${headerName}" contains characters that are not allowed.`);
+        if (headerValue && !disableHostCheck) {
+            verifyHostAllowed(headerName, headerValue, allowedHosts);
         }
     }
     const xForwardedPort = getFirstHeaderValue(headers.get('x-forwarded-port'));
@@ -204,10 +167,38 @@ function validateHeaders(request) {
         throw new Error('Header "x-forwarded-proto" must be either "http" or "https".');
     }
     const xForwardedPrefix = getFirstHeaderValue(headers.get('x-forwarded-prefix'));
-    if (xForwardedPrefix && INVALID_PREFIX_REGEX.test(xForwardedPrefix)) {
-        throw new Error('Header "x-forwarded-prefix" must not start with "\\" or multiple "/" or contain ".", ".." path segments.');
+    if (xForwardedPrefix && !VALID_PREFIX_REGEX.test(xForwardedPrefix)) {
+        throw new Error('Header "x-forwarded-prefix" is invalid. It must start with a "/" and contain ' +
+            'only alphanumeric characters, hyphens, and underscores, separated by single slashes.');
+    }
+}
+/**
+ * Checks if a specific proxy header is allowed.
+ *
+ * @param headerName - The name of the proxy header to check.
+ * @param trustProxyHeaders - A set of allowed proxy headers.
+ * @returns `true` if the header is allowed, `false` otherwise.
+ */
+function isProxyHeaderAllowed(headerName, trustProxyHeaders) {
+    return trustProxyHeaders.has(headerName.toLowerCase());
+}
+/**
+ * Normalizes the `trustProxyHeaders` option to a consistent representation.
+ * @param trustProxyHeaders The input `trustProxyHeaders` value.
+ * @returns A `Set<string>` of normalized header names.
+ */
+function normalizeTrustProxyHeaders(trustProxyHeaders) {
+    if (trustProxyHeaders === undefined) {
+        return new Set(['x-forwarded-host', 'x-forwarded-proto']);
+    }
+    if (trustProxyHeaders === false) {
+        return new Set();
+    }
+    if (trustProxyHeaders === true) {
+        return X_FORWARDED_HEADERS;
     }
+    return new Set(trustProxyHeaders.map((h) => h.toLowerCase()));
 }
 
-export { cloneRequestAndPatchHeaders, getFirstHeaderValue, validateRequest, validateUrl };
+export { getFirstHeaderValue, isProxyHeaderAllowed, normalizeTrustProxyHeaders, sanitizeRequestHeaders, validateRequest, validateUrl };
 //# sourceMappingURL=validation.mjs.map

package/fesm2022/validation.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"validation.mjs","sources":["../../../../../../darwin_arm64-fastbuild-ST-199a4f3c4e20/bin/packages/angular/ssr/src/utils/validation.ts"],"sourcesContent":["/**\n * @license\n * Copyright Google LLC All Rights Reserved.\n *\n * Use of this source code is governed by an MIT-style license that can be\n * found in the LICENSE file at https://angular.dev/license\n */\n\n/**\n * The set of headers that should be validated for host header injection attacks.\n */\nconst HOST_HEADERS_TO_VALIDATE: ReadonlySet<string> = new Set(['host', 'x-forwarded-host']);\n\n/**\n * Regular expression to validate that the port is a numeric value.\n */\nconst VALID_PORT_REGEX = /^\\d+$/;\n\n/**\n * Regular expression to validate that the protocol is either http or https (case-insensitive).\n */\nconst VALID_PROTO_REGEX = /^https?$/i;\n\n/**\n * Regular expression to validate that the host is a valid hostname.\n */\nconst VALID_HOST_REGEX = /^[a-z0-9.:-]+$/i;\n\n/**\n * Regular expression to validate that the prefix is valid.\n */\nconst INVALID_PREFIX_REGEX = /^(?:\\\\|\\/[/\\\\])|(?:^|[/\\\\])\\.\\.?(?:[/\\\\]|$)/;\n\n/**\n * Extracts the first value from a multi-value header string.\n *\n * @param value - A string or an array of strings representing the header values.\n *                If it's a string, values are expected to be comma-separated.\n * @returns The first trimmed value from the multi-value header, or `undefined` if the input is invalid or empty.\n *\n * @example\n * ```typescript\n * getFirstHeaderValue(\"value1, value2, value3\"); // \"value1\"\n * getFirstHeaderValue([\"value1\", \"value2\"]); // \"value1\"\n * getFirstHeaderValue(undefined); // undefined\n * ```\n */\nexport function getFirstHeaderValue(\n  value: string | string[] | undefined | null,\n): string | undefined {\n  return value?.toString().split(',', 1)[0]?.trim();\n}\n\n/**\n * Validates a request.\n *\n * @param request - The incoming `Request` object to validate.\n * @param allowedHosts - A set of allowed hostnames.\n * @throws Error if any of the validated headers contain invalid values.\n */\nexport function validateRequest(request: Request, allowedHosts: ReadonlySet<string>): void {\n  validateHeaders(request);\n  validateUrl(new URL(request.url), allowedHosts);\n}\n\n/**\n * Validates that the hostname of a given URL is allowed.\n *\n * @param url - The URL object to validate.\n * @param allowedHosts - A set of allowed hostnames.\n * @throws Error if the hostname is not in the allowlist.\n */\nexport function validateUrl(url: URL, allowedHosts: ReadonlySet<string>): void {\n  const { hostname } = url;\n  if (!isHostAllowed(hostname, allowedHosts)) {\n    throw new Error(`URL with hostname \"${hostname}\" is not allowed.`);\n  }\n}\n\n/**\n * Clones a request and patches the `get` method of the request headers to validate the host headers.\n * @param request - The request to validate.\n * @param allowedHosts - A set of allowed hostnames.\n * @returns An object containing the cloned request and a promise that resolves to an error\n * if any of the validated headers contain invalid values.\n */\nexport function cloneRequestAndPatchHeaders(\n  request: Request,\n  allowedHosts: ReadonlySet<string>,\n): { request: Request; onError: Promise<Error> } {\n  let onError: (value: Error) => void;\n  const onErrorPromise = new Promise<Error>((resolve) => {\n    onError = resolve;\n  });\n\n  const clonedReq = new Request(request.clone(), {\n    signal: request.signal,\n  });\n\n  const headers = clonedReq.headers;\n\n  const originalGet = headers.get;\n  // eslint-disable-next-line @typescript-eslint/no-unnecessary-type-assertion\n  (headers.get as typeof originalGet) = function (name) {\n    const value = originalGet.call(headers, name);\n    if (!value) {\n      return value;\n    }\n\n    validateHeader(name, value, allowedHosts, onError);\n\n    return value;\n  };\n\n  const originalValues = headers.values;\n  // eslint-disable-next-line @typescript-eslint/no-unnecessary-type-assertion\n  (headers.values as typeof originalValues) = function () {\n    for (const name of HOST_HEADERS_TO_VALIDATE) {\n      validateHeader(name, originalGet.call(headers, name), allowedHosts, onError);\n    }\n\n    return originalValues.call(headers);\n  };\n\n  const originalEntries = headers.entries;\n  // eslint-disable-next-line @typescript-eslint/no-unnecessary-type-assertion\n  (headers.entries as typeof originalEntries) = function () {\n    const iterator = originalEntries.call(headers);\n\n    return {\n      next() {\n        const result = iterator.next();\n        if (!result.done) {\n          const [key, value] = result.value;\n          validateHeader(key, value, allowedHosts, onError);\n        }\n\n        return result;\n      },\n      [Symbol.iterator]() {\n        return this;\n      },\n    };\n  };\n\n  // Ensure for...of loops use the new patched entries\n  (headers[Symbol.iterator] as typeof originalEntries) = headers.entries;\n\n  return { request: clonedReq, onError: onErrorPromise };\n}\n\n/**\n * Validates a specific header value against the allowed hosts.\n * @param name - The name of the header to validate.\n * @param value - The value of the header to validate.\n * @param allowedHosts - A set of allowed hostnames.\n * @param onError - A callback function to call if the header value is invalid.\n * @throws Error if the header value is invalid.\n */\nfunction validateHeader(\n  name: string,\n  value: string | null,\n  allowedHosts: ReadonlySet<string>,\n  onError: (value: Error) => void,\n): void {\n  if (!value) {\n    return;\n  }\n\n  if (!HOST_HEADERS_TO_VALIDATE.has(name.toLowerCase())) {\n    return;\n  }\n\n  try {\n    verifyHostAllowed(name, value, allowedHosts);\n  } catch (error) {\n    onError(error as Error);\n\n    throw error;\n  }\n}\n\n/**\n * Validates a specific host header value against the allowed hosts.\n *\n * @param headerName - The name of the header to validate (e.g., 'host', 'x-forwarded-host').\n * @param headerValue - The value of the header to validate.\n * @param allowedHosts - A set of allowed hostnames.\n * @throws Error if the header value is invalid or the hostname is not in the allowlist.\n */\nfunction verifyHostAllowed(\n  headerName: string,\n  headerValue: string,\n  allowedHosts: ReadonlySet<string>,\n): void {\n  const value = getFirstHeaderValue(headerValue);\n  if (!value) {\n    return;\n  }\n\n  const url = `http://${value}`;\n  if (!URL.canParse(url)) {\n    throw new Error(`Header \"${headerName}\" contains an invalid value and cannot be parsed.`);\n  }\n\n  const { hostname } = new URL(url);\n  if (!isHostAllowed(hostname, allowedHosts)) {\n    throw new Error(`Header \"${headerName}\" with value \"${value}\" is not allowed.`);\n  }\n}\n\n/**\n * Checks if the hostname is allowed.\n * @param hostname - The hostname to check.\n * @param allowedHosts - A set of allowed hostnames.\n * @returns `true` if the hostname is allowed, `false` otherwise.\n */\nfunction isHostAllowed(hostname: string, allowedHosts: ReadonlySet<string>): boolean {\n  if (allowedHosts.has(hostname)) {\n    return true;\n  }\n\n  for (const allowedHost of allowedHosts) {\n    if (!allowedHost.startsWith('*.')) {\n      continue;\n    }\n\n    const domain = allowedHost.slice(1);\n    if (hostname.endsWith(domain)) {\n      return true;\n    }\n  }\n\n  return false;\n}\n\n/**\n * Validates the headers of an incoming request.\n *\n * @param request - The incoming `Request` object containing the headers to validate.\n * @throws Error if any of the validated headers contain invalid values.\n */\nfunction validateHeaders(request: Request): void {\n  const headers = request.headers;\n  for (const headerName of HOST_HEADERS_TO_VALIDATE) {\n    const headerValue = getFirstHeaderValue(headers.get(headerName));\n    if (headerValue && !VALID_HOST_REGEX.test(headerValue)) {\n      throw new Error(`Header \"${headerName}\" contains characters that are not allowed.`);\n    }\n  }\n\n  const xForwardedPort = getFirstHeaderValue(headers.get('x-forwarded-port'));\n  if (xForwardedPort && !VALID_PORT_REGEX.test(xForwardedPort)) {\n    throw new Error('Header \"x-forwarded-port\" must be a numeric value.');\n  }\n\n  const xForwardedProto = getFirstHeaderValue(headers.get('x-forwarded-proto'));\n  if (xForwardedProto && !VALID_PROTO_REGEX.test(xForwardedProto)) {\n    throw new Error('Header \"x-forwarded-proto\" must be either \"http\" or \"https\".');\n  }\n\n  const xForwardedPrefix = getFirstHeaderValue(headers.get('x-forwarded-prefix'));\n  if (xForwardedPrefix && INVALID_PREFIX_REGEX.test(xForwardedPrefix)) {\n    throw new Error(\n      'Header \"x-forwarded-prefix\" must not start with \"\\\\\" or multiple \"/\" or contain \".\", \"..\" path segments.',\n    );\n  }\n}\n"],"names":[],"mappings":"AAQA;;AAEG;AACH,MAAM,wBAAwB,GAAwB,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;AAE3F;;AAEG;AACH,MAAM,gBAAgB,GAAG,OAAO;AAEhC;;AAEG;AACH,MAAM,iBAAiB,GAAG,WAAW;AAErC;;AAEG;AACH,MAAM,gBAAgB,GAAG,iBAAiB;AAE1C;;AAEG;AACH,MAAM,oBAAoB,GAAG,6CAA6C;AAE1E;;;;;;;;;;;;;AAaG;AACG,SAAU,mBAAmB,CACjC,KAA2C,EAAA;AAE3C,IAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE;AACnD;AAEA;;;;;;AAMG;AACa,SAAA,eAAe,CAAC,OAAgB,EAAE,YAAiC,EAAA;IACjF,eAAe,CAAC,OAAO,CAAC;IACxB,WAAW,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,YAAY,CAAC;AACjD;AAEA;;;;;;AAMG;AACa,SAAA,WAAW,CAAC,GAAQ,EAAE,YAAiC,EAAA;AACrE,IAAA,MAAM,EAAE,QAAQ,EAAE,GAAG,GAAG;IACxB,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,YAAY,CAAC,EAAE;AAC1C,QAAA,MAAM,IAAI,KAAK,CAAC,sBAAsB,QAAQ,CAAA,iBAAA,CAAmB,CAAC;;AAEtE;AAEA;;;;;;AAMG;AACa,SAAA,2BAA2B,CACzC,OAAgB,EAChB,YAAiC,EAAA;AAEjC,IAAA,IAAI,OAA+B;IACnC,MAAM,cAAc,GAAG,IAAI,OAAO,CAAQ,CAAC,OAAO,KAAI;QACpD,OAAO,GAAG,OAAO;AACnB,KAAC,CAAC;IAEF,MAAM,SAAS,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE;QAC7C,MAAM,EAAE,OAAO,CAAC,MAAM;AACvB,KAAA,CAAC;AAEF,IAAA,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO;AAEjC,IAAA,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG;;AAE9B,IAAA,OAAO,CAAC,GAA0B,GAAG,UAAU,IAAI,EAAA;QAClD,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC;QAC7C,IAAI,CAAC,KAAK,EAAE;AACV,YAAA,OAAO,KAAK;;QAGd,cAAc,CAAC,IAAI,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,CAAC;AAElD,QAAA,OAAO,KAAK;AACd,KAAC;AAED,IAAA,MAAM,cAAc,GAAG,OAAO,CAAC,MAAM;;IAEpC,OAAO,CAAC,MAAgC,GAAG,YAAA;AAC1C,QAAA,KAAK,MAAM,IAAI,IAAI,wBAAwB,EAAE;AAC3C,YAAA,cAAc,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC;;AAG9E,QAAA,OAAO,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC;AACrC,KAAC;AAED,IAAA,MAAM,eAAe,GAAG,OAAO,CAAC,OAAO;;IAEtC,OAAO,CAAC,OAAkC,GAAG,YAAA;QAC5C,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC;QAE9C,OAAO;YACL,IAAI,GAAA;AACF,gBAAA,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE;AAC9B,gBAAA,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE;oBAChB,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,MAAM,CAAC,KAAK;oBACjC,cAAc,CAAC,GAAG,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,CAAC;;AAGnD,gBAAA,OAAO,MAAM;aACd;YACD,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAA;AACf,gBAAA,OAAO,IAAI;aACZ;SACF;AACH,KAAC;;IAGA,OAAO,CAAC,MAAM,CAAC,QAAQ,CAA4B,GAAG,OAAO,CAAC,OAAO;IAEtE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,cAAc,EAAE;AACxD;AAEA;;;;;;;AAOG;AACH,SAAS,cAAc,CACrB,IAAY,EACZ,KAAoB,EACpB,YAAiC,EACjC,OAA+B,EAAA;IAE/B,IAAI,CAAC,KAAK,EAAE;QACV;;IAGF,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,EAAE;QACrD;;AAGF,IAAA,IAAI;AACF,QAAA,iBAAiB,CAAC,IAAI,EAAE,KAAK,EAAE,YAAY,CAAC;;IAC5C,OAAO,KAAK,EAAE;QACd,OAAO,CAAC,KAAc,CAAC;AAEvB,QAAA,MAAM,KAAK;;AAEf;AAEA;;;;;;;AAOG;AACH,SAAS,iBAAiB,CACxB,UAAkB,EAClB,WAAmB,EACnB,YAAiC,EAAA;AAEjC,IAAA,MAAM,KAAK,GAAG,mBAAmB,CAAC,WAAW,CAAC;IAC9C,IAAI,CAAC,KAAK,EAAE;QACV;;AAGF,IAAA,MAAM,GAAG,GAAG,CAAU,OAAA,EAAA,KAAK,EAAE;IAC7B,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE;AACtB,QAAA,MAAM,IAAI,KAAK,CAAC,WAAW,UAAU,CAAA,iDAAA,CAAmD,CAAC;;IAG3F,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC;IACjC,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,YAAY,CAAC,EAAE;QAC1C,MAAM,IAAI,KAAK,CAAC,CAAA,QAAA,EAAW,UAAU,CAAiB,cAAA,EAAA,KAAK,CAAmB,iBAAA,CAAA,CAAC;;AAEnF;AAEA;;;;;AAKG;AACH,SAAS,aAAa,CAAC,QAAgB,EAAE,YAAiC,EAAA;AACxE,IAAA,IAAI,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE;AAC9B,QAAA,OAAO,IAAI;;AAGb,IAAA,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE;QACtC,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE;YACjC;;QAGF,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;AACnC,QAAA,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE;AAC7B,YAAA,OAAO,IAAI;;;AAIf,IAAA,OAAO,KAAK;AACd;AAEA;;;;;AAKG;AACH,SAAS,eAAe,CAAC,OAAgB,EAAA;AACvC,IAAA,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO;AAC/B,IAAA,KAAK,MAAM,UAAU,IAAI,wBAAwB,EAAE;QACjD,MAAM,WAAW,GAAG,mBAAmB,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAChE,IAAI,WAAW,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE;AACtD,YAAA,MAAM,IAAI,KAAK,CAAC,WAAW,UAAU,CAAA,2CAAA,CAA6C,CAAC;;;IAIvF,MAAM,cAAc,GAAG,mBAAmB,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IAC3E,IAAI,cAAc,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE;AAC5D,QAAA,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC;;IAGvE,MAAM,eAAe,GAAG,mBAAmB,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IAC7E,IAAI,eAAe,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE;AAC/D,QAAA,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC;;IAGjF,MAAM,gBAAgB,GAAG,mBAAmB,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;IAC/E,IAAI,gBAAgB,IAAI,oBAAoB,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE;AACnE,QAAA,MAAM,IAAI,KAAK,CACb,0GAA0G,CAC3G;;AAEL;;;;"}
+{"version":3,"file":"validation.mjs","sources":["../../../../../../k8-fastbuild-ST-199a4f3c4e20/bin/packages/angular/ssr/src/utils/validation.ts"],"sourcesContent":["/**\n * @license\n * Copyright Google LLC All Rights Reserved.\n *\n * Use of this source code is governed by an MIT-style license that can be\n * found in the LICENSE file at https://angular.dev/license\n */\n\n/**\n * Common X-Forwarded-* headers.\n */\nconst X_FORWARDED_HEADERS = new Set([\n  'x-forwarded-for',\n  'x-forwarded-host',\n  'x-forwarded-port',\n  'x-forwarded-proto',\n  'x-forwarded-prefix',\n]);\n\n/**\n * The set of headers that should be validated for host header injection attacks.\n */\nconst HOST_HEADERS_TO_VALIDATE: ReadonlyArray<string> = ['host', 'x-forwarded-host'];\n\n/**\n * Regular expression to validate that the port is a numeric value.\n */\nconst VALID_PORT_REGEX = /^\\d+$/;\n\n/**\n * Regular expression to validate that the protocol is either http or https (case-insensitive).\n */\nconst VALID_PROTO_REGEX = /^https?$/i;\n\n/**\n * Regular expression to validate that the prefix is valid.\n */\nconst VALID_PREFIX_REGEX = /^\\/([a-z0-9_-]+\\/)*[a-z0-9_-]*$/i;\n\n/**\n * Extracts the first value from a multi-value header string.\n *\n * @param value - A string or an array of strings representing the header values.\n *                If it's a string, values are expected to be comma-separated.\n * @returns The first trimmed value from the multi-value header, or `undefined` if the input is invalid or empty.\n *\n * @example\n * ```typescript\n * getFirstHeaderValue(\"value1, value2, value3\"); // \"value1\"\n * getFirstHeaderValue([\"value1\", \"value2\"]); // \"value1\"\n * getFirstHeaderValue(undefined); // undefined\n * ```\n */\nexport function getFirstHeaderValue(\n  value: string | string[] | undefined | null,\n): string | undefined {\n  return value?.toString().split(',', 1)[0]?.trim();\n}\n\n/**\n * Validates a request.\n *\n * @param request - The incoming `Request` object to validate.\n * @param allowedHosts - A set of allowed hostnames.\n * @throws Error if any of the validated headers contain invalid values.\n */\nexport function validateRequest(\n  request: Request,\n  allowedHosts: ReadonlySet<string>,\n  disableHostCheck: boolean,\n): void {\n  validateHeaders(request, allowedHosts, disableHostCheck);\n\n  if (!disableHostCheck) {\n    validateUrl(new URL(request.url), allowedHosts);\n  }\n}\n\n/**\n * Validates that the hostname of a given URL is allowed.\n *\n * @param url - The URL object to validate.\n * @param allowedHosts - A set of allowed hostnames.\n * @throws Error if the hostname is not in the allowlist.\n */\nexport function validateUrl(url: URL, allowedHosts: ReadonlySet<string>): void {\n  const { hostname } = url;\n  if (!isHostAllowed(hostname, allowedHosts)) {\n    throw new Error(`URL with hostname \"${hostname}\" is not allowed.`);\n  }\n}\n\n/**\n * Sanitizes the proxy headers of a request by removing unallowed `X-Forwarded-*` headers.\n * If no headers need to be removed, the original request is returned without cloning.\n *\n * @param request - The incoming `Request` object to sanitize.\n * @param trustProxyHeaders - A set of allowed proxy headers.\n * @returns An object containing the sanitized request, or the original request if no changes were needed.\n */\nexport function sanitizeRequestHeaders(\n  request: Request,\n  trustProxyHeaders: ReadonlySet<string>,\n): { request: Request; deoptToCSR: boolean } {\n  const keysToDelete: string[] = [];\n  let deoptToCSR = false;\n\n  for (const [key] of request.headers) {\n    const lowerKey = key.toLowerCase();\n    if (lowerKey.startsWith('x-forwarded-') && !isProxyHeaderAllowed(lowerKey, trustProxyHeaders)) {\n      // eslint-disable-next-line no-console\n      console.warn(\n        `Received \"${key}\" header but \"trustProxyHeaders\" was not set up to allow it.\\n` +\n          `For more information, see https://angular.dev/best-practices/security#configuring-trusted-proxy-headers`,\n      );\n      deoptToCSR = true;\n      keysToDelete.push(key);\n    }\n  }\n\n  if (keysToDelete.length === 0) {\n    return { request, deoptToCSR };\n  }\n\n  const clonedReq = new Request(request.clone(), {\n    signal: request.signal,\n  });\n\n  const headers = clonedReq.headers;\n  for (const key of keysToDelete) {\n    headers.delete(key);\n  }\n\n  return { request: clonedReq, deoptToCSR };\n}\n\n/**\n * Validates a specific host header value against the allowed hosts.\n *\n * @param headerName - The name of the header to validate (e.g., 'host', 'x-forwarded-host').\n * @param headerValue - The value of the header to validate.\n * @param allowedHosts - A set of allowed hostnames.\n * @throws Error if the header value is invalid or the hostname is not in the allowlist.\n */\nfunction verifyHostAllowed(\n  headerName: string,\n  headerValue: string,\n  allowedHosts: ReadonlySet<string>,\n): void {\n  const url = `http://${headerValue}`;\n  if (!URL.canParse(url)) {\n    throw new Error(`Header \"${headerName}\" contains an invalid value and cannot be parsed.`);\n  }\n\n  const { hostname, pathname, search, hash, username, password } = new URL(url);\n  if (pathname !== '/' || search || hash || username || password) {\n    throw new Error(\n      `Header \"${headerName}\" with value \"${headerValue}\" contains characters that are not allowed.`,\n    );\n  }\n\n  if (!isHostAllowed(hostname, allowedHosts)) {\n    throw new Error(`Header \"${headerName}\" with value \"${headerValue}\" is not allowed.`);\n  }\n}\n\n/**\n * Checks if the hostname is allowed.\n * @param hostname - The hostname to check.\n * @param allowedHosts - A set of allowed hostnames.\n * @returns `true` if the hostname is allowed, `false` otherwise.\n */\nfunction isHostAllowed(hostname: string, allowedHosts: ReadonlySet<string>): boolean {\n  if (allowedHosts.has(hostname)) {\n    return true;\n  }\n\n  for (const allowedHost of allowedHosts) {\n    if (!allowedHost.startsWith('*.')) {\n      continue;\n    }\n\n    const domain = allowedHost.slice(1);\n    if (hostname.endsWith(domain)) {\n      return true;\n    }\n  }\n\n  return false;\n}\n\n/**\n * Validates the headers of an incoming request.\n *\n * @param request - The incoming `Request` object containing the headers to validate.\n * @param allowedHosts - A set of allowed hostnames.\n * @param disableHostCheck - Whether to disable the host check.\n * @throws Error if any of the validated headers contain invalid values.\n */\nfunction validateHeaders(\n  request: Request,\n  allowedHosts: ReadonlySet<string>,\n  disableHostCheck: boolean,\n): void {\n  const headers = request.headers;\n  for (const headerName of HOST_HEADERS_TO_VALIDATE) {\n    const headerValue = getFirstHeaderValue(headers.get(headerName));\n    if (headerValue && !disableHostCheck) {\n      verifyHostAllowed(headerName, headerValue, allowedHosts);\n    }\n  }\n\n  const xForwardedPort = getFirstHeaderValue(headers.get('x-forwarded-port'));\n  if (xForwardedPort && !VALID_PORT_REGEX.test(xForwardedPort)) {\n    throw new Error('Header \"x-forwarded-port\" must be a numeric value.');\n  }\n\n  const xForwardedProto = getFirstHeaderValue(headers.get('x-forwarded-proto'));\n  if (xForwardedProto && !VALID_PROTO_REGEX.test(xForwardedProto)) {\n    throw new Error('Header \"x-forwarded-proto\" must be either \"http\" or \"https\".');\n  }\n\n  const xForwardedPrefix = getFirstHeaderValue(headers.get('x-forwarded-prefix'));\n  if (xForwardedPrefix && !VALID_PREFIX_REGEX.test(xForwardedPrefix)) {\n    throw new Error(\n      'Header \"x-forwarded-prefix\" is invalid. It must start with a \"/\" and contain ' +\n        'only alphanumeric characters, hyphens, and underscores, separated by single slashes.',\n    );\n  }\n}\n\n/**\n * Checks if a specific proxy header is allowed.\n *\n * @param headerName - The name of the proxy header to check.\n * @param trustProxyHeaders - A set of allowed proxy headers.\n * @returns `true` if the header is allowed, `false` otherwise.\n */\nexport function isProxyHeaderAllowed(\n  headerName: string,\n  trustProxyHeaders: ReadonlySet<string>,\n): boolean {\n  return trustProxyHeaders.has(headerName.toLowerCase());\n}\n\n/**\n * Normalizes the `trustProxyHeaders` option to a consistent representation.\n * @param trustProxyHeaders The input `trustProxyHeaders` value.\n * @returns A `Set<string>` of normalized header names.\n */\nexport function normalizeTrustProxyHeaders(\n  trustProxyHeaders: boolean | readonly string[] | undefined,\n): ReadonlySet<string> {\n  if (trustProxyHeaders === undefined) {\n    return new Set(['x-forwarded-host', 'x-forwarded-proto']);\n  }\n\n  if (trustProxyHeaders === false) {\n    return new Set();\n  }\n\n  if (trustProxyHeaders === true) {\n    return X_FORWARDED_HEADERS;\n  }\n\n  return new Set(trustProxyHeaders.map((h) => h.toLowerCase()));\n}\n"],"names":[],"mappings":"AAQA;;AAEG;AACH,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IAClC,iBAAiB;IACjB,kBAAkB;IAClB,kBAAkB;IAClB,mBAAmB;IACnB,oBAAoB;AACrB,CAAA,CAAC;AAEF;;AAEG;AACH,MAAM,wBAAwB,GAA0B,CAAC,MAAM,EAAE,kBAAkB,CAAC;AAEpF;;AAEG;AACH,MAAM,gBAAgB,GAAG,OAAO;AAEhC;;AAEG;AACH,MAAM,iBAAiB,GAAG,WAAW;AAErC;;AAEG;AACH,MAAM,kBAAkB,GAAG,kCAAkC;AAE7D;;;;;;;;;;;;;AAaG;AACG,SAAU,mBAAmB,CACjC,KAA2C,EAAA;AAE3C,IAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE;AACnD;AAEA;;;;;;AAMG;SACa,eAAe,CAC7B,OAAgB,EAChB,YAAiC,EACjC,gBAAyB,EAAA;AAEzB,IAAA,eAAe,CAAC,OAAO,EAAE,YAAY,EAAE,gBAAgB,CAAC;IAExD,IAAI,CAAC,gBAAgB,EAAE;QACrB,WAAW,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,YAAY,CAAC;;AAEnD;AAEA;;;;;;AAMG;AACa,SAAA,WAAW,CAAC,GAAQ,EAAE,YAAiC,EAAA;AACrE,IAAA,MAAM,EAAE,QAAQ,EAAE,GAAG,GAAG;IACxB,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,YAAY,CAAC,EAAE;AAC1C,QAAA,MAAM,IAAI,KAAK,CAAC,sBAAsB,QAAQ,CAAA,iBAAA,CAAmB,CAAC;;AAEtE;AAEA;;;;;;;AAOG;AACa,SAAA,sBAAsB,CACpC,OAAgB,EAChB,iBAAsC,EAAA;IAEtC,MAAM,YAAY,GAAa,EAAE;IACjC,IAAI,UAAU,GAAG,KAAK;IAEtB,KAAK,MAAM,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE;AACnC,QAAA,MAAM,QAAQ,GAAG,GAAG,CAAC,WAAW,EAAE;AAClC,QAAA,IAAI,QAAQ,CAAC,UAAU,CAAC,cAAc,CAAC,IAAI,CAAC,oBAAoB,CAAC,QAAQ,EAAE,iBAAiB,CAAC,EAAE;;AAE7F,YAAA,OAAO,CAAC,IAAI,CACV,CAAA,UAAA,EAAa,GAAG,CAAgE,8DAAA,CAAA;AAC9E,gBAAA,CAAA,uGAAA,CAAyG,CAC5G;YACD,UAAU,GAAG,IAAI;AACjB,YAAA,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC;;;AAI1B,IAAA,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE;AAC7B,QAAA,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE;;IAGhC,MAAM,SAAS,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE;QAC7C,MAAM,EAAE,OAAO,CAAC,MAAM;AACvB,KAAA,CAAC;AAEF,IAAA,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO;AACjC,IAAA,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE;AAC9B,QAAA,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC;;AAGrB,IAAA,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE;AAC3C;AAEA;;;;;;;AAOG;AACH,SAAS,iBAAiB,CACxB,UAAkB,EAClB,WAAmB,EACnB,YAAiC,EAAA;AAEjC,IAAA,MAAM,GAAG,GAAG,CAAU,OAAA,EAAA,WAAW,EAAE;IACnC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE;AACtB,QAAA,MAAM,IAAI,KAAK,CAAC,WAAW,UAAU,CAAA,iDAAA,CAAmD,CAAC;;AAG3F,IAAA,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC;AAC7E,IAAA,IAAI,QAAQ,KAAK,GAAG,IAAI,MAAM,IAAI,IAAI,IAAI,QAAQ,IAAI,QAAQ,EAAE;QAC9D,MAAM,IAAI,KAAK,CACb,CAAA,QAAA,EAAW,UAAU,CAAiB,cAAA,EAAA,WAAW,CAA6C,2CAAA,CAAA,CAC/F;;IAGH,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,YAAY,CAAC,EAAE;QAC1C,MAAM,IAAI,KAAK,CAAC,CAAA,QAAA,EAAW,UAAU,CAAiB,cAAA,EAAA,WAAW,CAAmB,iBAAA,CAAA,CAAC;;AAEzF;AAEA;;;;;AAKG;AACH,SAAS,aAAa,CAAC,QAAgB,EAAE,YAAiC,EAAA;AACxE,IAAA,IAAI,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE;AAC9B,QAAA,OAAO,IAAI;;AAGb,IAAA,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE;QACtC,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE;YACjC;;QAGF,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;AACnC,QAAA,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE;AAC7B,YAAA,OAAO,IAAI;;;AAIf,IAAA,OAAO,KAAK;AACd;AAEA;;;;;;;AAOG;AACH,SAAS,eAAe,CACtB,OAAgB,EAChB,YAAiC,EACjC,gBAAyB,EAAA;AAEzB,IAAA,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO;AAC/B,IAAA,KAAK,MAAM,UAAU,IAAI,wBAAwB,EAAE;QACjD,MAAM,WAAW,GAAG,mBAAmB,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;AAChE,QAAA,IAAI,WAAW,IAAI,CAAC,gBAAgB,EAAE;AACpC,YAAA,iBAAiB,CAAC,UAAU,EAAE,WAAW,EAAE,YAAY,CAAC;;;IAI5D,MAAM,cAAc,GAAG,mBAAmB,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IAC3E,IAAI,cAAc,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE;AAC5D,QAAA,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC;;IAGvE,MAAM,eAAe,GAAG,mBAAmB,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IAC7E,IAAI,eAAe,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE;AAC/D,QAAA,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC;;IAGjF,MAAM,gBAAgB,GAAG,mBAAmB,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;IAC/E,IAAI,gBAAgB,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE;QAClE,MAAM,IAAI,KAAK,CACb,+EAA+E;AAC7E,YAAA,sFAAsF,CACzF;;AAEL;AAEA;;;;;;AAMG;AACa,SAAA,oBAAoB,CAClC,UAAkB,EAClB,iBAAsC,EAAA;IAEtC,OAAO,iBAAiB,CAAC,GAAG,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC;AACxD;AAEA;;;;AAIG;AACG,SAAU,0BAA0B,CACxC,iBAA0D,EAAA;AAE1D,IAAA,IAAI,iBAAiB,KAAK,SAAS,EAAE;QACnC,OAAO,IAAI,GAAG,CAAC,CAAC,kBAAkB,EAAE,mBAAmB,CAAC,CAAC;;AAG3D,IAAA,IAAI,iBAAiB,KAAK,KAAK,EAAE;QAC/B,OAAO,IAAI,GAAG,EAAE;;AAGlB,IAAA,IAAI,iBAAiB,KAAK,IAAI,EAAE;AAC9B,QAAA,OAAO,mBAAmB;;AAG5B,IAAA,OAAO,IAAI,GAAG,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;AAC/D;;;;"}

package/node/index.d.ts

@@ -70,6 +70,7 @@ interface AngularNodeAppEngineOptions extends AngularAppEngineOptions {
  */
 declare class AngularNodeAppEngine {
     private readonly angularAppEngine;
+    private readonly trustProxyHeaders?;
     /**
      * Creates a new instance of the Angular Node.js server application engine.
      * @param options Options for the Angular Node.js server application engine.
@@ -181,9 +182,16 @@ declare function writeResponseToNodeResponse(source: Response, destination: Serv
  * be used by web platform APIs.
  *
  * @param nodeRequest - The Node.js request object (`IncomingMessage` or `Http2ServerRequest`) to convert.
+ * @param trustProxyHeaders - A boolean or an array of proxy headers to trust when constructing the request URL.
+ *
+ * @remarks
+ * When `trustProxyHeaders` is enabled, headers such as `X-Forwarded-Host` and
+ * `X-Forwarded-Prefix` should ideally be strictly validated at a higher infrastructure
+ * level (e.g., at the reverse proxy or API gateway) before reaching the application.
+ *
  * @returns A Web Standard `Request` object.
  */
-declare function createWebRequestFromNodeRequest(nodeRequest: IncomingMessage | Http2ServerRequest): Request;
+declare function createWebRequestFromNodeRequest(nodeRequest: IncomingMessage | Http2ServerRequest, trustProxyHeaders?: boolean | readonly string[]): Request;
 
 /**
  * Determines whether the provided URL represents the main entry point module.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@angular/ssr",
-  "version": "20.3.24",
+  "version": "20.3.26",
   "description": "Angular server side rendering utilities",
   "type": "module",
   "license": "MIT",

package/third_party/beasties/THIRD_PARTY_LICENSES.txt

@@ -449,7 +449,7 @@ License: MIT
 
 The MIT License (MIT)
 
-Copyright 2013 Andrey Sitnik <andrey@sitnik.ru>
+Copyright 2013 Andrey Sitnik <andrey@sitnik.es>
 
 Permission is hereby granted, free of charge, to any person obtaining a copy of
 this software and associated documentation files (the "Software"), to deal in