@angular/ssr 21.2.0-rc.2 → 21.2.1

package/fesm2022/_validation-chunk.mjs

@@ -6,9 +6,11 @@ const INVALID_PREFIX_REGEX = /^[/\\]{2}|(?:^|[/\\])\.\.?(?:[/\\]|$)/;
 function getFirstHeaderValue(value) {
   return value?.toString().split(',', 1)[0]?.trim();
 }
-function validateRequest(request, allowedHosts) {
+function validateRequest(request, allowedHosts, disableHostCheck) {
   validateHeaders(request);
-  validateUrl(new URL(request.url), allowedHosts);
+  if (!disableHostCheck) {
+    validateUrl(new URL(request.url), allowedHosts);
+  }
 }
 function validateUrl(url, allowedHosts) {
   const {

package/fesm2022/_validation-chunk.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"_validation-chunk.mjs","sources":["../../../../../../k8-fastbuild-ST-fdfa778d11ba/bin/packages/angular/ssr/src/utils/validation.ts"],"sourcesContent":["/**\n * @license\n * Copyright Google LLC All Rights Reserved.\n *\n * Use of this source code is governed by an MIT-style license that can be\n * found in the LICENSE file at https://angular.dev/license\n */\n\n/**\n * The set of headers that should be validated for host header injection attacks.\n */\nconst HOST_HEADERS_TO_VALIDATE: ReadonlySet<string> = new Set(['host', 'x-forwarded-host']);\n\n/**\n * Regular expression to validate that the port is a numeric value.\n */\nconst VALID_PORT_REGEX = /^\\d+$/;\n\n/**\n * Regular expression to validate that the protocol is either http or https (case-insensitive).\n */\nconst VALID_PROTO_REGEX = /^https?$/i;\n\n/**\n * Regular expression to validate that the host is a valid hostname.\n */\nconst VALID_HOST_REGEX = /^[a-z0-9.:-]+$/i;\n\n/**\n * Regular expression to validate that the prefix is valid.\n */\nconst INVALID_PREFIX_REGEX = /^[/\\\\]{2}|(?:^|[/\\\\])\\.\\.?(?:[/\\\\]|$)/;\n\n/**\n * Extracts the first value from a multi-value header string.\n *\n * @param value - A string or an array of strings representing the header values.\n *                If it's a string, values are expected to be comma-separated.\n * @returns The first trimmed value from the multi-value header, or `undefined` if the input is invalid or empty.\n *\n * @example\n * ```typescript\n * getFirstHeaderValue(\"value1, value2, value3\"); // \"value1\"\n * getFirstHeaderValue([\"value1\", \"value2\"]); // \"value1\"\n * getFirstHeaderValue(undefined); // undefined\n * ```\n */\nexport function getFirstHeaderValue(\n  value: string | string[] | undefined | null,\n): string | undefined {\n  return value?.toString().split(',', 1)[0]?.trim();\n}\n\n/**\n * Validates a request.\n *\n * @param request - The incoming `Request` object to validate.\n * @param allowedHosts - A set of allowed hostnames.\n * @throws Error if any of the validated headers contain invalid values.\n */\nexport function validateRequest(request: Request, allowedHosts: ReadonlySet<string>): void {\n  validateHeaders(request);\n  validateUrl(new URL(request.url), allowedHosts);\n}\n\n/**\n * Validates that the hostname of a given URL is allowed.\n *\n * @param url - The URL object to validate.\n * @param allowedHosts - A set of allowed hostnames.\n * @throws Error if the hostname is not in the allowlist.\n */\nexport function validateUrl(url: URL, allowedHosts: ReadonlySet<string>): void {\n  const { hostname } = url;\n  if (!isHostAllowed(hostname, allowedHosts)) {\n    throw new Error(`URL with hostname \"${hostname}\" is not allowed.`);\n  }\n}\n\n/**\n * Clones a request and patches the `get` method of the request headers to validate the host headers.\n * @param request - The request to validate.\n * @param allowedHosts - A set of allowed hostnames.\n * @returns An object containing the cloned request and a promise that resolves to an error\n * if any of the validated headers contain invalid values.\n */\nexport function cloneRequestAndPatchHeaders(\n  request: Request,\n  allowedHosts: ReadonlySet<string>,\n): { request: Request; onError: Promise<Error> } {\n  let onError: (value: Error) => void;\n  const onErrorPromise = new Promise<Error>((resolve) => {\n    onError = resolve;\n  });\n\n  const clonedReq = new Request(request.clone(), {\n    signal: request.signal,\n  });\n\n  const headers = clonedReq.headers;\n\n  const originalGet = headers.get;\n  // eslint-disable-next-line @typescript-eslint/no-unnecessary-type-assertion\n  (headers.get as typeof originalGet) = function (name) {\n    const value = originalGet.call(headers, name);\n    if (!value) {\n      return value;\n    }\n\n    validateHeader(name, value, allowedHosts, onError);\n\n    return value;\n  };\n\n  const originalValues = headers.values;\n  // eslint-disable-next-line @typescript-eslint/no-unnecessary-type-assertion\n  (headers.values as typeof originalValues) = function () {\n    for (const name of HOST_HEADERS_TO_VALIDATE) {\n      validateHeader(name, originalGet.call(headers, name), allowedHosts, onError);\n    }\n\n    return originalValues.call(headers);\n  };\n\n  const originalEntries = headers.entries;\n  // eslint-disable-next-line @typescript-eslint/no-unnecessary-type-assertion\n  (headers.entries as typeof originalEntries) = function () {\n    const iterator = originalEntries.call(headers);\n\n    return {\n      next() {\n        const result = iterator.next();\n        if (!result.done) {\n          const [key, value] = result.value;\n          validateHeader(key, value, allowedHosts, onError);\n        }\n\n        return result;\n      },\n      [Symbol.iterator]() {\n        return this;\n      },\n    };\n  };\n\n  // Ensure for...of loops use the new patched entries\n  (headers[Symbol.iterator] as typeof originalEntries) = headers.entries;\n\n  return { request: clonedReq, onError: onErrorPromise };\n}\n\n/**\n * Validates a specific header value against the allowed hosts.\n * @param name - The name of the header to validate.\n * @param value - The value of the header to validate.\n * @param allowedHosts - A set of allowed hostnames.\n * @param onError - A callback function to call if the header value is invalid.\n * @throws Error if the header value is invalid.\n */\nfunction validateHeader(\n  name: string,\n  value: string | null,\n  allowedHosts: ReadonlySet<string>,\n  onError: (value: Error) => void,\n): void {\n  if (!value) {\n    return;\n  }\n\n  if (!HOST_HEADERS_TO_VALIDATE.has(name.toLowerCase())) {\n    return;\n  }\n\n  try {\n    verifyHostAllowed(name, value, allowedHosts);\n  } catch (error) {\n    onError(error as Error);\n\n    throw error;\n  }\n}\n\n/**\n * Validates a specific host header value against the allowed hosts.\n *\n * @param headerName - The name of the header to validate (e.g., 'host', 'x-forwarded-host').\n * @param headerValue - The value of the header to validate.\n * @param allowedHosts - A set of allowed hostnames.\n * @throws Error if the header value is invalid or the hostname is not in the allowlist.\n */\nfunction verifyHostAllowed(\n  headerName: string,\n  headerValue: string,\n  allowedHosts: ReadonlySet<string>,\n): void {\n  const value = getFirstHeaderValue(headerValue);\n  if (!value) {\n    return;\n  }\n\n  const url = `http://${value}`;\n  if (!URL.canParse(url)) {\n    throw new Error(`Header \"${headerName}\" contains an invalid value and cannot be parsed.`);\n  }\n\n  const { hostname } = new URL(url);\n  if (!isHostAllowed(hostname, allowedHosts)) {\n    throw new Error(`Header \"${headerName}\" with value \"${value}\" is not allowed.`);\n  }\n}\n\n/**\n * Checks if the hostname is allowed.\n * @param hostname - The hostname to check.\n * @param allowedHosts - A set of allowed hostnames.\n * @returns `true` if the hostname is allowed, `false` otherwise.\n */\nfunction isHostAllowed(hostname: string, allowedHosts: ReadonlySet<string>): boolean {\n  if (allowedHosts.has(hostname)) {\n    return true;\n  }\n\n  for (const allowedHost of allowedHosts) {\n    if (!allowedHost.startsWith('*.')) {\n      continue;\n    }\n\n    const domain = allowedHost.slice(1);\n    if (hostname.endsWith(domain)) {\n      return true;\n    }\n  }\n\n  return false;\n}\n\n/**\n * Validates the headers of an incoming request.\n *\n * @param request - The incoming `Request` object containing the headers to validate.\n * @throws Error if any of the validated headers contain invalid values.\n */\nfunction validateHeaders(request: Request): void {\n  const headers = request.headers;\n  for (const headerName of HOST_HEADERS_TO_VALIDATE) {\n    const headerValue = getFirstHeaderValue(headers.get(headerName));\n    if (headerValue && !VALID_HOST_REGEX.test(headerValue)) {\n      throw new Error(`Header \"${headerName}\" contains characters that are not allowed.`);\n    }\n  }\n\n  const xForwardedPort = getFirstHeaderValue(headers.get('x-forwarded-port'));\n  if (xForwardedPort && !VALID_PORT_REGEX.test(xForwardedPort)) {\n    throw new Error('Header \"x-forwarded-port\" must be a numeric value.');\n  }\n\n  const xForwardedProto = getFirstHeaderValue(headers.get('x-forwarded-proto'));\n  if (xForwardedProto && !VALID_PROTO_REGEX.test(xForwardedProto)) {\n    throw new Error('Header \"x-forwarded-proto\" must be either \"http\" or \"https\".');\n  }\n\n  const xForwardedPrefix = getFirstHeaderValue(headers.get('x-forwarded-prefix'));\n  if (xForwardedPrefix && INVALID_PREFIX_REGEX.test(xForwardedPrefix)) {\n    throw new Error(\n      'Header \"x-forwarded-prefix\" must not start with multiple \"/\" or \"\\\\\" or contain \".\", \"..\" path segments.',\n    );\n  }\n}\n"],"names":["HOST_HEADERS_TO_VALIDATE","Set","VALID_PORT_REGEX","VALID_PROTO_REGEX","VALID_HOST_REGEX","INVALID_PREFIX_REGEX","getFirstHeaderValue","value","toString","split","trim","validateRequest","request","allowedHosts","validateHeaders","validateUrl","URL","url","hostname","isHostAllowed","Error","cloneRequestAndPatchHeaders","onError","onErrorPromise","Promise","resolve","clonedReq","Request","clone","signal","headers","originalGet","get","name","call","validateHeader","originalValues","values","originalEntries","entries","iterator","next","result","done","key","Symbol","has","toLowerCase","verifyHostAllowed","error","headerName","headerValue","canParse","allowedHost","startsWith","domain","slice","endsWith","test","xForwardedPort","xForwardedProto","xForwardedPrefix"],"mappings":"AAWA,MAAMA,wBAAwB,GAAwB,IAAIC,GAAG,CAAC,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;AAK3F,MAAMC,gBAAgB,GAAG,OAAO;AAKhC,MAAMC,iBAAiB,GAAG,WAAW;AAKrC,MAAMC,gBAAgB,GAAG,iBAAiB;AAK1C,MAAMC,oBAAoB,GAAG,uCAAuC;AAgB9D,SAAUC,mBAAmBA,CACjCC,KAA2C,EAAA;AAE3C,EAAA,OAAOA,KAAK,EAAEC,QAAQ,EAAE,CAACC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAEC,IAAI,EAAE;AACnD;AASgB,SAAAC,eAAeA,CAACC,OAAgB,EAAEC,YAAiC,EAAA;EACjFC,eAAe,CAACF,OAAO,CAAC;EACxBG,WAAW,CAAC,IAAIC,GAAG,CAACJ,OAAO,CAACK,GAAG,CAAC,EAAEJ,YAAY,CAAC;AACjD;AASgB,SAAAE,WAAWA,CAACE,GAAQ,EAAEJ,YAAiC,EAAA;EACrE,MAAM;AAAEK,IAAAA;AAAU,GAAA,GAAGD,GAAG;AACxB,EAAA,IAAI,CAACE,aAAa,CAACD,QAAQ,EAAEL,YAAY,CAAC,EAAE;AAC1C,IAAA,MAAM,IAAIO,KAAK,CAAC,CAAsBF,mBAAAA,EAAAA,QAAQ,mBAAmB,CAAC;AACpE;AACF;AASgB,SAAAG,2BAA2BA,CACzCT,OAAgB,EAChBC,YAAiC,EAAA;AAEjC,EAAA,IAAIS,OAA+B;AACnC,EAAA,MAAMC,cAAc,GAAG,IAAIC,OAAO,CAASC,OAAO,IAAI;AACpDH,IAAAA,OAAO,GAAGG,OAAO;AACnB,GAAC,CAAC;EAEF,MAAMC,SAAS,GAAG,IAAIC,OAAO,CAACf,OAAO,CAACgB,KAAK,EAAE,EAAE;IAC7CC,MAAM,EAAEjB,OAAO,CAACiB;AACjB,GAAA,CAAC;AAEF,EAAA,MAAMC,OAAO,GAAGJ,SAAS,CAACI,OAAO;AAEjC,EAAA,MAAMC,WAAW,GAAGD,OAAO,CAACE,GAAG;AAE9BF,EAAAA,OAAO,CAACE,GAA0B,GAAG,UAAUC,IAAI,EAAA;IAClD,MAAM1B,KAAK,GAAGwB,WAAW,CAACG,IAAI,CAACJ,OAAO,EAAEG,IAAI,CAAC;IAC7C,IAAI,CAAC1B,KAAK,EAAE;AACV,MAAA,OAAOA,KAAK;AACd;IAEA4B,cAAc,CAACF,IAAI,EAAE1B,KAAK,EAAEM,YAAY,EAAES,OAAO,CAAC;AAElD,IAAA,OAAOf,KAAK;GACb;AAED,EAAA,MAAM6B,cAAc,GAAGN,OAAO,CAACO,MAAM;EAEpCP,OAAO,CAACO,MAAgC,GAAG,YAAA;AAC1C,IAAA,KAAK,MAAMJ,IAAI,IAAIjC,wBAAwB,EAAE;AAC3CmC,MAAAA,cAAc,CAACF,IAAI,EAAEF,WAAW,CAACG,IAAI,CAACJ,OAAO,EAAEG,IAAI,CAAC,EAAEpB,YAAY,EAAES,OAAO,CAAC;AAC9E;AAEA,IAAA,OAAOc,cAAc,CAACF,IAAI,CAACJ,OAAO,CAAC;GACpC;AAED,EAAA,MAAMQ,eAAe,GAAGR,OAAO,CAACS,OAAO;EAEtCT,OAAO,CAACS,OAAkC,GAAG,YAAA;AAC5C,IAAA,MAAMC,QAAQ,GAAGF,eAAe,CAACJ,IAAI,CAACJ,OAAO,CAAC;IAE9C,OAAO;AACLW,MAAAA,IAAIA,GAAA;AACF,QAAA,MAAMC,MAAM,GAAGF,QAAQ,CAACC,IAAI,EAAE;AAC9B,QAAA,IAAI,CAACC,MAAM,CAACC,IAAI,EAAE;UAChB,MAAM,CAACC,GAAG,EAAErC,KAAK,CAAC,GAAGmC,MAAM,CAACnC,KAAK;UACjC4B,cAAc,CAACS,GAAG,EAAErC,KAAK,EAAEM,YAAY,EAAES,OAAO,CAAC;AACnD;AAEA,QAAA,OAAOoB,MAAM;OACd;MACD,CAACG,MAAM,CAACL,QAAQ,CAAC,GAAA;AACf,QAAA,OAAO,IAAI;AACb;KACD;GACF;EAGAV,OAAO,CAACe,MAAM,CAACL,QAAQ,CAA4B,GAAGV,OAAO,CAACS,OAAO;EAEtE,OAAO;AAAE3B,IAAAA,OAAO,EAAEc,SAAS;AAAEJ,IAAAA,OAAO,EAAEC;GAAgB;AACxD;AAUA,SAASY,cAAcA,CACrBF,IAAY,EACZ1B,KAAoB,EACpBM,YAAiC,EACjCS,OAA+B,EAAA;EAE/B,IAAI,CAACf,KAAK,EAAE;AACV,IAAA;AACF;EAEA,IAAI,CAACP,wBAAwB,CAAC8C,GAAG,CAACb,IAAI,CAACc,WAAW,EAAE,CAAC,EAAE;AACrD,IAAA;AACF;EAEA,IAAI;AACFC,IAAAA,iBAAiB,CAACf,IAAI,EAAE1B,KAAK,EAAEM,YAAY,CAAC;GAC9C,CAAE,OAAOoC,KAAK,EAAE;IACd3B,OAAO,CAAC2B,KAAc,CAAC;AAEvB,IAAA,MAAMA,KAAK;AACb;AACF;AAUA,SAASD,iBAAiBA,CACxBE,UAAkB,EAClBC,WAAmB,EACnBtC,YAAiC,EAAA;AAEjC,EAAA,MAAMN,KAAK,GAAGD,mBAAmB,CAAC6C,WAAW,CAAC;EAC9C,IAAI,CAAC5C,KAAK,EAAE;AACV,IAAA;AACF;AAEA,EAAA,MAAMU,GAAG,GAAG,CAAUV,OAAAA,EAAAA,KAAK,CAAE,CAAA;AAC7B,EAAA,IAAI,CAACS,GAAG,CAACoC,QAAQ,CAACnC,GAAG,CAAC,EAAE;AACtB,IAAA,MAAM,IAAIG,KAAK,CAAC,CAAW8B,QAAAA,EAAAA,UAAU,mDAAmD,CAAC;AAC3F;EAEA,MAAM;AAAEhC,IAAAA;AAAU,GAAA,GAAG,IAAIF,GAAG,CAACC,GAAG,CAAC;AACjC,EAAA,IAAI,CAACE,aAAa,CAACD,QAAQ,EAAEL,YAAY,CAAC,EAAE;IAC1C,MAAM,IAAIO,KAAK,CAAC,CAAA,QAAA,EAAW8B,UAAU,CAAiB3C,cAAAA,EAAAA,KAAK,mBAAmB,CAAC;AACjF;AACF;AAQA,SAASY,aAAaA,CAACD,QAAgB,EAAEL,YAAiC,EAAA;AACxE,EAAA,IAAIA,YAAY,CAACiC,GAAG,CAAC5B,QAAQ,CAAC,EAAE;AAC9B,IAAA,OAAO,IAAI;AACb;AAEA,EAAA,KAAK,MAAMmC,WAAW,IAAIxC,YAAY,EAAE;AACtC,IAAA,IAAI,CAACwC,WAAW,CAACC,UAAU,CAAC,IAAI,CAAC,EAAE;AACjC,MAAA;AACF;AAEA,IAAA,MAAMC,MAAM,GAAGF,WAAW,CAACG,KAAK,CAAC,CAAC,CAAC;AACnC,IAAA,IAAItC,QAAQ,CAACuC,QAAQ,CAACF,MAAM,CAAC,EAAE;AAC7B,MAAA,OAAO,IAAI;AACb;AACF;AAEA,EAAA,OAAO,KAAK;AACd;AAQA,SAASzC,eAAeA,CAACF,OAAgB,EAAA;AACvC,EAAA,MAAMkB,OAAO,GAAGlB,OAAO,CAACkB,OAAO;AAC/B,EAAA,KAAK,MAAMoB,UAAU,IAAIlD,wBAAwB,EAAE;IACjD,MAAMmD,WAAW,GAAG7C,mBAAmB,CAACwB,OAAO,CAACE,GAAG,CAACkB,UAAU,CAAC,CAAC;IAChE,IAAIC,WAAW,IAAI,CAAC/C,gBAAgB,CAACsD,IAAI,CAACP,WAAW,CAAC,EAAE;AACtD,MAAA,MAAM,IAAI/B,KAAK,CAAC,CAAW8B,QAAAA,EAAAA,UAAU,6CAA6C,CAAC;AACrF;AACF;EAEA,MAAMS,cAAc,GAAGrD,mBAAmB,CAACwB,OAAO,CAACE,GAAG,CAAC,kBAAkB,CAAC,CAAC;EAC3E,IAAI2B,cAAc,IAAI,CAACzD,gBAAgB,CAACwD,IAAI,CAACC,cAAc,CAAC,EAAE;AAC5D,IAAA,MAAM,IAAIvC,KAAK,CAAC,oDAAoD,CAAC;AACvE;EAEA,MAAMwC,eAAe,GAAGtD,mBAAmB,CAACwB,OAAO,CAACE,GAAG,CAAC,mBAAmB,CAAC,CAAC;EAC7E,IAAI4B,eAAe,IAAI,CAACzD,iBAAiB,CAACuD,IAAI,CAACE,eAAe,CAAC,EAAE;AAC/D,IAAA,MAAM,IAAIxC,KAAK,CAAC,8DAA8D,CAAC;AACjF;EAEA,MAAMyC,gBAAgB,GAAGvD,mBAAmB,CAACwB,OAAO,CAACE,GAAG,CAAC,oBAAoB,CAAC,CAAC;EAC/E,IAAI6B,gBAAgB,IAAIxD,oBAAoB,CAACqD,IAAI,CAACG,gBAAgB,CAAC,EAAE;AACnE,IAAA,MAAM,IAAIzC,KAAK,CACb,0GAA0G,CAC3G;AACH;AACF;;;;"}
+{"version":3,"file":"_validation-chunk.mjs","sources":["../../../../../../k8-fastbuild-ST-fdfa778d11ba/bin/packages/angular/ssr/src/utils/validation.ts"],"sourcesContent":["/**\n * @license\n * Copyright Google LLC All Rights Reserved.\n *\n * Use of this source code is governed by an MIT-style license that can be\n * found in the LICENSE file at https://angular.dev/license\n */\n\n/**\n * The set of headers that should be validated for host header injection attacks.\n */\nconst HOST_HEADERS_TO_VALIDATE: ReadonlySet<string> = new Set(['host', 'x-forwarded-host']);\n\n/**\n * Regular expression to validate that the port is a numeric value.\n */\nconst VALID_PORT_REGEX = /^\\d+$/;\n\n/**\n * Regular expression to validate that the protocol is either http or https (case-insensitive).\n */\nconst VALID_PROTO_REGEX = /^https?$/i;\n\n/**\n * Regular expression to validate that the host is a valid hostname.\n */\nconst VALID_HOST_REGEX = /^[a-z0-9.:-]+$/i;\n\n/**\n * Regular expression to validate that the prefix is valid.\n */\nconst INVALID_PREFIX_REGEX = /^[/\\\\]{2}|(?:^|[/\\\\])\\.\\.?(?:[/\\\\]|$)/;\n\n/**\n * Extracts the first value from a multi-value header string.\n *\n * @param value - A string or an array of strings representing the header values.\n *                If it's a string, values are expected to be comma-separated.\n * @returns The first trimmed value from the multi-value header, or `undefined` if the input is invalid or empty.\n *\n * @example\n * ```typescript\n * getFirstHeaderValue(\"value1, value2, value3\"); // \"value1\"\n * getFirstHeaderValue([\"value1\", \"value2\"]); // \"value1\"\n * getFirstHeaderValue(undefined); // undefined\n * ```\n */\nexport function getFirstHeaderValue(\n  value: string | string[] | undefined | null,\n): string | undefined {\n  return value?.toString().split(',', 1)[0]?.trim();\n}\n\n/**\n * Validates a request.\n *\n * @param request - The incoming `Request` object to validate.\n * @param allowedHosts - A set of allowed hostnames.\n * @param disableHostCheck - Whether to disable the host check.\n * @throws Error if any of the validated headers contain invalid values.\n */\nexport function validateRequest(\n  request: Request,\n  allowedHosts: ReadonlySet<string>,\n  disableHostCheck: boolean,\n): void {\n  validateHeaders(request);\n\n  if (!disableHostCheck) {\n    validateUrl(new URL(request.url), allowedHosts);\n  }\n}\n\n/**\n * Validates that the hostname of a given URL is allowed.\n *\n * @param url - The URL object to validate.\n * @param allowedHosts - A set of allowed hostnames.\n * @throws Error if the hostname is not in the allowlist.\n */\nexport function validateUrl(url: URL, allowedHosts: ReadonlySet<string>): void {\n  const { hostname } = url;\n  if (!isHostAllowed(hostname, allowedHosts)) {\n    throw new Error(`URL with hostname \"${hostname}\" is not allowed.`);\n  }\n}\n\n/**\n * Clones a request and patches the `get` method of the request headers to validate the host headers.\n * @param request - The request to validate.\n * @param allowedHosts - A set of allowed hostnames.\n * @returns An object containing the cloned request and a promise that resolves to an error\n * if any of the validated headers contain invalid values.\n */\nexport function cloneRequestAndPatchHeaders(\n  request: Request,\n  allowedHosts: ReadonlySet<string>,\n): { request: Request; onError: Promise<Error> } {\n  let onError: (value: Error) => void;\n  const onErrorPromise = new Promise<Error>((resolve) => {\n    onError = resolve;\n  });\n\n  const clonedReq = new Request(request.clone(), {\n    signal: request.signal,\n  });\n\n  const headers = clonedReq.headers;\n\n  const originalGet = headers.get;\n  // eslint-disable-next-line @typescript-eslint/no-unnecessary-type-assertion\n  (headers.get as typeof originalGet) = function (name) {\n    const value = originalGet.call(headers, name);\n    if (!value) {\n      return value;\n    }\n\n    validateHeader(name, value, allowedHosts, onError);\n\n    return value;\n  };\n\n  const originalValues = headers.values;\n  // eslint-disable-next-line @typescript-eslint/no-unnecessary-type-assertion\n  (headers.values as typeof originalValues) = function () {\n    for (const name of HOST_HEADERS_TO_VALIDATE) {\n      validateHeader(name, originalGet.call(headers, name), allowedHosts, onError);\n    }\n\n    return originalValues.call(headers);\n  };\n\n  const originalEntries = headers.entries;\n  // eslint-disable-next-line @typescript-eslint/no-unnecessary-type-assertion\n  (headers.entries as typeof originalEntries) = function () {\n    const iterator = originalEntries.call(headers);\n\n    return {\n      next() {\n        const result = iterator.next();\n        if (!result.done) {\n          const [key, value] = result.value;\n          validateHeader(key, value, allowedHosts, onError);\n        }\n\n        return result;\n      },\n      [Symbol.iterator]() {\n        return this;\n      },\n    };\n  };\n\n  // Ensure for...of loops use the new patched entries\n  (headers[Symbol.iterator] as typeof originalEntries) = headers.entries;\n\n  return { request: clonedReq, onError: onErrorPromise };\n}\n\n/**\n * Validates a specific header value against the allowed hosts.\n * @param name - The name of the header to validate.\n * @param value - The value of the header to validate.\n * @param allowedHosts - A set of allowed hostnames.\n * @param onError - A callback function to call if the header value is invalid.\n * @throws Error if the header value is invalid.\n */\nfunction validateHeader(\n  name: string,\n  value: string | null,\n  allowedHosts: ReadonlySet<string>,\n  onError: (value: Error) => void,\n): void {\n  if (!value) {\n    return;\n  }\n\n  if (!HOST_HEADERS_TO_VALIDATE.has(name.toLowerCase())) {\n    return;\n  }\n\n  try {\n    verifyHostAllowed(name, value, allowedHosts);\n  } catch (error) {\n    onError(error as Error);\n\n    throw error;\n  }\n}\n\n/**\n * Validates a specific host header value against the allowed hosts.\n *\n * @param headerName - The name of the header to validate (e.g., 'host', 'x-forwarded-host').\n * @param headerValue - The value of the header to validate.\n * @param allowedHosts - A set of allowed hostnames.\n * @throws Error if the header value is invalid or the hostname is not in the allowlist.\n */\nfunction verifyHostAllowed(\n  headerName: string,\n  headerValue: string,\n  allowedHosts: ReadonlySet<string>,\n): void {\n  const value = getFirstHeaderValue(headerValue);\n  if (!value) {\n    return;\n  }\n\n  const url = `http://${value}`;\n  if (!URL.canParse(url)) {\n    throw new Error(`Header \"${headerName}\" contains an invalid value and cannot be parsed.`);\n  }\n\n  const { hostname } = new URL(url);\n  if (!isHostAllowed(hostname, allowedHosts)) {\n    throw new Error(`Header \"${headerName}\" with value \"${value}\" is not allowed.`);\n  }\n}\n\n/**\n * Checks if the hostname is allowed.\n * @param hostname - The hostname to check.\n * @param allowedHosts - A set of allowed hostnames.\n * @returns `true` if the hostname is allowed, `false` otherwise.\n */\nfunction isHostAllowed(hostname: string, allowedHosts: ReadonlySet<string>): boolean {\n  if (allowedHosts.has(hostname)) {\n    return true;\n  }\n\n  for (const allowedHost of allowedHosts) {\n    if (!allowedHost.startsWith('*.')) {\n      continue;\n    }\n\n    const domain = allowedHost.slice(1);\n    if (hostname.endsWith(domain)) {\n      return true;\n    }\n  }\n\n  return false;\n}\n\n/**\n * Validates the headers of an incoming request.\n *\n * @param request - The incoming `Request` object containing the headers to validate.\n * @throws Error if any of the validated headers contain invalid values.\n */\nfunction validateHeaders(request: Request): void {\n  const headers = request.headers;\n  for (const headerName of HOST_HEADERS_TO_VALIDATE) {\n    const headerValue = getFirstHeaderValue(headers.get(headerName));\n    if (headerValue && !VALID_HOST_REGEX.test(headerValue)) {\n      throw new Error(`Header \"${headerName}\" contains characters that are not allowed.`);\n    }\n  }\n\n  const xForwardedPort = getFirstHeaderValue(headers.get('x-forwarded-port'));\n  if (xForwardedPort && !VALID_PORT_REGEX.test(xForwardedPort)) {\n    throw new Error('Header \"x-forwarded-port\" must be a numeric value.');\n  }\n\n  const xForwardedProto = getFirstHeaderValue(headers.get('x-forwarded-proto'));\n  if (xForwardedProto && !VALID_PROTO_REGEX.test(xForwardedProto)) {\n    throw new Error('Header \"x-forwarded-proto\" must be either \"http\" or \"https\".');\n  }\n\n  const xForwardedPrefix = getFirstHeaderValue(headers.get('x-forwarded-prefix'));\n  if (xForwardedPrefix && INVALID_PREFIX_REGEX.test(xForwardedPrefix)) {\n    throw new Error(\n      'Header \"x-forwarded-prefix\" must not start with multiple \"/\" or \"\\\\\" or contain \".\", \"..\" path segments.',\n    );\n  }\n}\n"],"names":["HOST_HEADERS_TO_VALIDATE","Set","VALID_PORT_REGEX","VALID_PROTO_REGEX","VALID_HOST_REGEX","INVALID_PREFIX_REGEX","getFirstHeaderValue","value","toString","split","trim","validateRequest","request","allowedHosts","disableHostCheck","validateHeaders","validateUrl","URL","url","hostname","isHostAllowed","Error","cloneRequestAndPatchHeaders","onError","onErrorPromise","Promise","resolve","clonedReq","Request","clone","signal","headers","originalGet","get","name","call","validateHeader","originalValues","values","originalEntries","entries","iterator","next","result","done","key","Symbol","has","toLowerCase","verifyHostAllowed","error","headerName","headerValue","canParse","allowedHost","startsWith","domain","slice","endsWith","test","xForwardedPort","xForwardedProto","xForwardedPrefix"],"mappings":"AAWA,MAAMA,wBAAwB,GAAwB,IAAIC,GAAG,CAAC,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;AAK3F,MAAMC,gBAAgB,GAAG,OAAO;AAKhC,MAAMC,iBAAiB,GAAG,WAAW;AAKrC,MAAMC,gBAAgB,GAAG,iBAAiB;AAK1C,MAAMC,oBAAoB,GAAG,uCAAuC;AAgB9D,SAAUC,mBAAmBA,CACjCC,KAA2C,EAAA;AAE3C,EAAA,OAAOA,KAAK,EAAEC,QAAQ,EAAE,CAACC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAEC,IAAI,EAAE;AACnD;SAUgBC,eAAeA,CAC7BC,OAAgB,EAChBC,YAAiC,EACjCC,gBAAyB,EAAA;EAEzBC,eAAe,CAACH,OAAO,CAAC;EAExB,IAAI,CAACE,gBAAgB,EAAE;IACrBE,WAAW,CAAC,IAAIC,GAAG,CAACL,OAAO,CAACM,GAAG,CAAC,EAAEL,YAAY,CAAC;AACjD;AACF;AASgB,SAAAG,WAAWA,CAACE,GAAQ,EAAEL,YAAiC,EAAA;EACrE,MAAM;AAAEM,IAAAA;AAAU,GAAA,GAAGD,GAAG;AACxB,EAAA,IAAI,CAACE,aAAa,CAACD,QAAQ,EAAEN,YAAY,CAAC,EAAE;AAC1C,IAAA,MAAM,IAAIQ,KAAK,CAAC,CAAsBF,mBAAAA,EAAAA,QAAQ,mBAAmB,CAAC;AACpE;AACF;AASgB,SAAAG,2BAA2BA,CACzCV,OAAgB,EAChBC,YAAiC,EAAA;AAEjC,EAAA,IAAIU,OAA+B;AACnC,EAAA,MAAMC,cAAc,GAAG,IAAIC,OAAO,CAASC,OAAO,IAAI;AACpDH,IAAAA,OAAO,GAAGG,OAAO;AACnB,GAAC,CAAC;EAEF,MAAMC,SAAS,GAAG,IAAIC,OAAO,CAAChB,OAAO,CAACiB,KAAK,EAAE,EAAE;IAC7CC,MAAM,EAAElB,OAAO,CAACkB;AACjB,GAAA,CAAC;AAEF,EAAA,MAAMC,OAAO,GAAGJ,SAAS,CAACI,OAAO;AAEjC,EAAA,MAAMC,WAAW,GAAGD,OAAO,CAACE,GAAG;AAE9BF,EAAAA,OAAO,CAACE,GAA0B,GAAG,UAAUC,IAAI,EAAA;IAClD,MAAM3B,KAAK,GAAGyB,WAAW,CAACG,IAAI,CAACJ,OAAO,EAAEG,IAAI,CAAC;IAC7C,IAAI,CAAC3B,KAAK,EAAE;AACV,MAAA,OAAOA,KAAK;AACd;IAEA6B,cAAc,CAACF,IAAI,EAAE3B,KAAK,EAAEM,YAAY,EAAEU,OAAO,CAAC;AAElD,IAAA,OAAOhB,KAAK;GACb;AAED,EAAA,MAAM8B,cAAc,GAAGN,OAAO,CAACO,MAAM;EAEpCP,OAAO,CAACO,MAAgC,GAAG,YAAA;AAC1C,IAAA,KAAK,MAAMJ,IAAI,IAAIlC,wBAAwB,EAAE;AAC3CoC,MAAAA,cAAc,CAACF,IAAI,EAAEF,WAAW,CAACG,IAAI,CAACJ,OAAO,EAAEG,IAAI,CAAC,EAAErB,YAAY,EAAEU,OAAO,CAAC;AAC9E;AAEA,IAAA,OAAOc,cAAc,CAACF,IAAI,CAACJ,OAAO,CAAC;GACpC;AAED,EAAA,MAAMQ,eAAe,GAAGR,OAAO,CAACS,OAAO;EAEtCT,OAAO,CAACS,OAAkC,GAAG,YAAA;AAC5C,IAAA,MAAMC,QAAQ,GAAGF,eAAe,CAACJ,IAAI,CAACJ,OAAO,CAAC;IAE9C,OAAO;AACLW,MAAAA,IAAIA,GAAA;AACF,QAAA,MAAMC,MAAM,GAAGF,QAAQ,CAACC,IAAI,EAAE;AAC9B,QAAA,IAAI,CAACC,MAAM,CAACC,IAAI,EAAE;UAChB,MAAM,CAACC,GAAG,EAAEtC,KAAK,CAAC,GAAGoC,MAAM,CAACpC,KAAK;UACjC6B,cAAc,CAACS,GAAG,EAAEtC,KAAK,EAAEM,YAAY,EAAEU,OAAO,CAAC;AACnD;AAEA,QAAA,OAAOoB,MAAM;OACd;MACD,CAACG,MAAM,CAACL,QAAQ,CAAC,GAAA;AACf,QAAA,OAAO,IAAI;AACb;KACD;GACF;EAGAV,OAAO,CAACe,MAAM,CAACL,QAAQ,CAA4B,GAAGV,OAAO,CAACS,OAAO;EAEtE,OAAO;AAAE5B,IAAAA,OAAO,EAAEe,SAAS;AAAEJ,IAAAA,OAAO,EAAEC;GAAgB;AACxD;AAUA,SAASY,cAAcA,CACrBF,IAAY,EACZ3B,KAAoB,EACpBM,YAAiC,EACjCU,OAA+B,EAAA;EAE/B,IAAI,CAAChB,KAAK,EAAE;AACV,IAAA;AACF;EAEA,IAAI,CAACP,wBAAwB,CAAC+C,GAAG,CAACb,IAAI,CAACc,WAAW,EAAE,CAAC,EAAE;AACrD,IAAA;AACF;EAEA,IAAI;AACFC,IAAAA,iBAAiB,CAACf,IAAI,EAAE3B,KAAK,EAAEM,YAAY,CAAC;GAC9C,CAAE,OAAOqC,KAAK,EAAE;IACd3B,OAAO,CAAC2B,KAAc,CAAC;AAEvB,IAAA,MAAMA,KAAK;AACb;AACF;AAUA,SAASD,iBAAiBA,CACxBE,UAAkB,EAClBC,WAAmB,EACnBvC,YAAiC,EAAA;AAEjC,EAAA,MAAMN,KAAK,GAAGD,mBAAmB,CAAC8C,WAAW,CAAC;EAC9C,IAAI,CAAC7C,KAAK,EAAE;AACV,IAAA;AACF;AAEA,EAAA,MAAMW,GAAG,GAAG,CAAUX,OAAAA,EAAAA,KAAK,CAAE,CAAA;AAC7B,EAAA,IAAI,CAACU,GAAG,CAACoC,QAAQ,CAACnC,GAAG,CAAC,EAAE;AACtB,IAAA,MAAM,IAAIG,KAAK,CAAC,CAAW8B,QAAAA,EAAAA,UAAU,mDAAmD,CAAC;AAC3F;EAEA,MAAM;AAAEhC,IAAAA;AAAU,GAAA,GAAG,IAAIF,GAAG,CAACC,GAAG,CAAC;AACjC,EAAA,IAAI,CAACE,aAAa,CAACD,QAAQ,EAAEN,YAAY,CAAC,EAAE;IAC1C,MAAM,IAAIQ,KAAK,CAAC,CAAA,QAAA,EAAW8B,UAAU,CAAiB5C,cAAAA,EAAAA,KAAK,mBAAmB,CAAC;AACjF;AACF;AAQA,SAASa,aAAaA,CAACD,QAAgB,EAAEN,YAAiC,EAAA;AACxE,EAAA,IAAIA,YAAY,CAACkC,GAAG,CAAC5B,QAAQ,CAAC,EAAE;AAC9B,IAAA,OAAO,IAAI;AACb;AAEA,EAAA,KAAK,MAAMmC,WAAW,IAAIzC,YAAY,EAAE;AACtC,IAAA,IAAI,CAACyC,WAAW,CAACC,UAAU,CAAC,IAAI,CAAC,EAAE;AACjC,MAAA;AACF;AAEA,IAAA,MAAMC,MAAM,GAAGF,WAAW,CAACG,KAAK,CAAC,CAAC,CAAC;AACnC,IAAA,IAAItC,QAAQ,CAACuC,QAAQ,CAACF,MAAM,CAAC,EAAE;AAC7B,MAAA,OAAO,IAAI;AACb;AACF;AAEA,EAAA,OAAO,KAAK;AACd;AAQA,SAASzC,eAAeA,CAACH,OAAgB,EAAA;AACvC,EAAA,MAAMmB,OAAO,GAAGnB,OAAO,CAACmB,OAAO;AAC/B,EAAA,KAAK,MAAMoB,UAAU,IAAInD,wBAAwB,EAAE;IACjD,MAAMoD,WAAW,GAAG9C,mBAAmB,CAACyB,OAAO,CAACE,GAAG,CAACkB,UAAU,CAAC,CAAC;IAChE,IAAIC,WAAW,IAAI,CAAChD,gBAAgB,CAACuD,IAAI,CAACP,WAAW,CAAC,EAAE;AACtD,MAAA,MAAM,IAAI/B,KAAK,CAAC,CAAW8B,QAAAA,EAAAA,UAAU,6CAA6C,CAAC;AACrF;AACF;EAEA,MAAMS,cAAc,GAAGtD,mBAAmB,CAACyB,OAAO,CAACE,GAAG,CAAC,kBAAkB,CAAC,CAAC;EAC3E,IAAI2B,cAAc,IAAI,CAAC1D,gBAAgB,CAACyD,IAAI,CAACC,cAAc,CAAC,EAAE;AAC5D,IAAA,MAAM,IAAIvC,KAAK,CAAC,oDAAoD,CAAC;AACvE;EAEA,MAAMwC,eAAe,GAAGvD,mBAAmB,CAACyB,OAAO,CAACE,GAAG,CAAC,mBAAmB,CAAC,CAAC;EAC7E,IAAI4B,eAAe,IAAI,CAAC1D,iBAAiB,CAACwD,IAAI,CAACE,eAAe,CAAC,EAAE;AAC/D,IAAA,MAAM,IAAIxC,KAAK,CAAC,8DAA8D,CAAC;AACjF;EAEA,MAAMyC,gBAAgB,GAAGxD,mBAAmB,CAACyB,OAAO,CAACE,GAAG,CAAC,oBAAoB,CAAC,CAAC;EAC/E,IAAI6B,gBAAgB,IAAIzD,oBAAoB,CAACsD,IAAI,CAACG,gBAAgB,CAAC,EAAE;AACnE,IAAA,MAAM,IAAIzC,KAAK,CACb,0GAA0G,CAC3G;AACH;AACF;;;;"}

package/fesm2022/ssr.mjs

@@ -407,6 +407,10 @@ class RouteTree {
   }
 }
 
+const IS_DISCOVERING_ROUTES = new InjectionToken(typeof ngDevMode === 'undefined' || ngDevMode ? 'IS_DISCOVERING_ROUTES' : '', {
+  providedIn: 'platform',
+  factory: () => false
+});
 const MODULE_PRELOAD_MAX = 10;
 const CATCH_ALL_REGEXP = /\/(\*\*)$/;
 const URL_PARAMETER_REGEXP = /(?<!\\):([^/]+)/g;
@@ -716,6 +720,9 @@ async function getRoutesFromAngularRouterConfig(bootstrap, document, url, invoke
   }, {
     provide: _ENABLE_ROOT_COMPONENT_BOOTSTRAP,
     useValue: false
+  }, {
+    provide: IS_DISCOVERING_ROUTES,
+    useValue: true
   }]);
   try {
     let applicationRef;
@@ -1467,6 +1474,7 @@ function normalizeLocale(locale) {
 
 class AngularAppEngine {
   static ɵallowStaticRouteRender = false;
+  static ɵdisableAllowedHostsCheck = false;
   static ɵhooks = new Hooks();
   manifest = getAngularAppEngineManifest();
   allowedHosts;
@@ -1477,18 +1485,27 @@ class AngularAppEngine {
   }
   async handle(request, requestContext) {
     const allowedHost = this.allowedHosts;
+    const disableAllowedHostsCheck = AngularAppEngine.ɵdisableAllowedHostsCheck;
     try {
-      validateRequest(request, allowedHost);
+      validateRequest(request, allowedHost, disableAllowedHostsCheck);
     } catch (error) {
       return this.handleValidationError(error, request);
     }
     const {
       request: securedRequest,
       onError: onHeaderValidationError
-    } = cloneRequestAndPatchHeaders(request, allowedHost);
+    } = disableAllowedHostsCheck ? {
+      request,
+      onError: null
+    } : cloneRequestAndPatchHeaders(request, allowedHost);
     const serverApp = await this.getAngularServerAppForRequest(securedRequest);
     if (serverApp) {
-      return Promise.race([onHeaderValidationError.then(error => this.handleValidationError(error, securedRequest)), serverApp.handle(securedRequest, requestContext)]);
+      const promises = [];
+      if (onHeaderValidationError) {
+        promises.push(onHeaderValidationError.then(error => this.handleValidationError(error, securedRequest)));
+      }
+      promises.push(serverApp.handle(securedRequest, requestContext));
+      return Promise.race(promises);
     }
     if (this.supportedLocales.length > 1) {
       return this.redirectBasedOnAcceptLanguage(request);
@@ -1584,5 +1601,5 @@ function createRequestHandler(handler) {
   return handler;
 }
 
-export { AngularAppEngine, PrerenderFallback, RenderMode, createRequestHandler, provideServerRendering, withAppShell, withRoutes, InlineCriticalCssProcessor as ɵInlineCriticalCssProcessor, destroyAngularServerApp as ɵdestroyAngularServerApp, extractRoutesAndCreateRouteTree as ɵextractRoutesAndCreateRouteTree, getOrCreateAngularServerApp as ɵgetOrCreateAngularServerApp, getRoutesFromAngularRouterConfig as ɵgetRoutesFromAngularRouterConfig, setAngularAppEngineManifest as ɵsetAngularAppEngineManifest, setAngularAppManifest as ɵsetAngularAppManifest };
+export { AngularAppEngine, IS_DISCOVERING_ROUTES, PrerenderFallback, RenderMode, createRequestHandler, provideServerRendering, withAppShell, withRoutes, InlineCriticalCssProcessor as ɵInlineCriticalCssProcessor, destroyAngularServerApp as ɵdestroyAngularServerApp, extractRoutesAndCreateRouteTree as ɵextractRoutesAndCreateRouteTree, getOrCreateAngularServerApp as ɵgetOrCreateAngularServerApp, getRoutesFromAngularRouterConfig as ɵgetRoutesFromAngularRouterConfig, setAngularAppEngineManifest as ɵsetAngularAppEngineManifest, setAngularAppManifest as ɵsetAngularAppManifest };
 //# sourceMappingURL=ssr.mjs.map