@angular/ssr 22.0.0-next.8 → 22.0.0-rc.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
const
|
|
1
|
+
const TRUST_ALL_PROXY_HEADERS = '*';
|
|
2
2
|
const HOST_HEADERS_TO_VALIDATE = ['host', 'x-forwarded-host'];
|
|
3
3
|
const VALID_PORT_REGEX = /^\d+$/;
|
|
4
4
|
const VALID_PROTO_REGEX = /^https?$/i;
|
|
@@ -94,16 +94,20 @@ function validateHeaders(request, allowedHosts, disableHostCheck) {
|
|
|
94
94
|
}
|
|
95
95
|
}
|
|
96
96
|
function isProxyHeaderAllowed(headerName, trustProxyHeaders) {
|
|
97
|
-
return trustProxyHeaders.has(headerName.toLowerCase());
|
|
97
|
+
return trustProxyHeaders.has(TRUST_ALL_PROXY_HEADERS) || trustProxyHeaders.has(headerName.toLowerCase());
|
|
98
98
|
}
|
|
99
99
|
function normalizeTrustProxyHeaders(trustProxyHeaders) {
|
|
100
100
|
if (!trustProxyHeaders) {
|
|
101
101
|
return new Set();
|
|
102
102
|
}
|
|
103
103
|
if (trustProxyHeaders === true) {
|
|
104
|
-
return
|
|
104
|
+
return new Set([TRUST_ALL_PROXY_HEADERS]);
|
|
105
105
|
}
|
|
106
|
-
|
|
106
|
+
const normalizedTrustedProxyHeaders = new Set(trustProxyHeaders.map(h => h.toLowerCase()));
|
|
107
|
+
if (normalizedTrustedProxyHeaders.has(TRUST_ALL_PROXY_HEADERS)) {
|
|
108
|
+
throw new Error(`"${TRUST_ALL_PROXY_HEADERS}" is not allowed as a value for the "trustProxyHeaders" option.`);
|
|
109
|
+
}
|
|
110
|
+
return normalizedTrustedProxyHeaders;
|
|
107
111
|
}
|
|
108
112
|
|
|
109
113
|
export { getFirstHeaderValue, isProxyHeaderAllowed, normalizeTrustProxyHeaders, sanitizeRequestHeaders, validateRequest, validateUrl };
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"_validation-chunk.mjs","sources":["../../../../../../darwin_arm64-fastbuild-ST-fdfa778d11ba/bin/packages/angular/ssr/src/utils/validation.ts"],"sourcesContent":["/**\n * @license\n * Copyright Google LLC All Rights Reserved.\n *\n * Use of this source code is governed by an MIT-style license that can be\n * found in the LICENSE file at https://angular.dev/license\n */\n\n/**\n * Common X-Forwarded-* headers.\n */\nconst X_FORWARDED_HEADERS: ReadonlySet<string> = new Set([\n 'x-forwarded-for',\n 'x-forwarded-host',\n 'x-forwarded-port',\n 'x-forwarded-proto',\n 'x-forwarded-prefix',\n]);\n\n/**\n * The set of headers that should be validated for host header injection attacks.\n */\nconst HOST_HEADERS_TO_VALIDATE: ReadonlyArray<string> = ['host', 'x-forwarded-host'];\n\n/**\n * Regular expression to validate that the port is a numeric value.\n */\nconst VALID_PORT_REGEX = /^\\d+$/;\n\n/**\n * Regular expression to validate that the protocol is either http or https (case-insensitive).\n */\nconst VALID_PROTO_REGEX = /^https?$/i;\n\n/**\n * Regular expression to validate that the prefix is valid. Validates that the prefix is a valid path prefix and nothing else.\n * It validates that the prefix starts with a forward slash and contains only letters, numbers, hyphens, underscores and forward slashes.\n */\nconst VALID_PREFIX_REGEX = /^\\/([a-z0-9_-]+\\/)*[a-z0-9_-]*$/i;\n\n/**\n * Extracts the first value from a multi-value header string.\n *\n * @param value - A string or an array of strings representing the header values.\n * If it's a string, values are expected to be comma-separated.\n * @returns The first trimmed value from the multi-value header, or `undefined` if the input is invalid or empty.\n *\n * @example\n * ```typescript\n * getFirstHeaderValue(\"value1, value2, value3\"); // \"value1\"\n * getFirstHeaderValue([\"value1\", \"value2\"]); // \"value1\"\n * getFirstHeaderValue(undefined); // undefined\n * ```\n */\nexport function getFirstHeaderValue(\n value: string | string[] | undefined | null,\n): string | undefined {\n return value?.toString().split(',', 1)[0]?.trim();\n}\n\n/**\n * Validates a request.\n *\n * @param request - The incoming `Request` object to validate.\n * @param allowedHosts - A set of allowed hostnames.\n * @param disableHostCheck - Whether to disable the host check.\n * @throws Error if any of the validated headers contain invalid values.\n */\nexport function validateRequest(\n request: Request,\n allowedHosts: ReadonlySet<string>,\n disableHostCheck: boolean,\n): void {\n validateHeaders(request, allowedHosts, disableHostCheck);\n\n if (!disableHostCheck) {\n validateUrl(new URL(request.url), allowedHosts);\n }\n}\n\n/**\n * Validates that the hostname of a given URL is allowed.\n *\n * @param url - The URL object to validate.\n * @param allowedHosts - A set of allowed hostnames.\n * @throws Error if the hostname is not in the allowlist.\n */\nexport function validateUrl(url: URL, allowedHosts: ReadonlySet<string>): void {\n const { hostname } = url;\n if (!isHostAllowed(hostname, allowedHosts)) {\n throw new Error(`URL with hostname \"${hostname}\" is not allowed.`);\n }\n}\n\n/**\n * Sanitizes the proxy headers of a request by removing unallowed `X-Forwarded-*` headers.\n * If no headers need to be removed, the original request is returned without cloning.\n *\n * @param request - The incoming `Request` object to sanitize.\n * @param trustProxyHeaders - A set of allowed proxy headers.\n * @returns The sanitized request, or the original request if no changes were needed.\n */\nexport function sanitizeRequestHeaders(\n request: Request,\n trustProxyHeaders: ReadonlySet<string>,\n): Request {\n let headersDeleted = false;\n const headers = new Headers();\n\n for (const [key, value] of request.headers) {\n const lowerKey = key.toLowerCase();\n if (lowerKey.startsWith('x-forwarded-') && !isProxyHeaderAllowed(lowerKey, trustProxyHeaders)) {\n // eslint-disable-next-line no-console\n console.warn(\n `Received \"${key}\" header but \"trustProxyHeaders\" was not set up to allow it.\\n` +\n `For more information, see https://angular.dev/best-practices/security#configuring-trusted-proxy-headers`,\n );\n headersDeleted = true;\n } else {\n headers.set(key, value);\n }\n }\n\n return headersDeleted\n ? new Request(request.clone(), {\n signal: request.signal,\n headers,\n })\n : request;\n}\n\n/**\n * Validates a specific host header value against the allowed hosts.\n *\n * @param headerName - The name of the header to validate (e.g., 'host', 'x-forwarded-host').\n * @param headerValue - The value of the header to validate.\n * @param allowedHosts - A set of allowed hostnames.\n * @throws Error if the header value is invalid or the hostname is not in the allowlist.\n */\nfunction verifyHostAllowed(\n headerName: string,\n headerValue: string,\n allowedHosts: ReadonlySet<string>,\n): void {\n const url = `http://${headerValue}`;\n if (!URL.canParse(url)) {\n throw new Error(`Header \"${headerName}\" contains an invalid value and cannot be parsed.`);\n }\n\n const { hostname, pathname, search, hash, username, password } = new URL(url);\n if (pathname !== '/' || search || hash || username || password) {\n throw new Error(\n `Header \"${headerName}\" with value \"${headerValue}\" contains characters that are not allowed.`,\n );\n }\n\n if (!isHostAllowed(hostname, allowedHosts)) {\n throw new Error(`Header \"${headerName}\" with value \"${headerValue}\" is not allowed.`);\n }\n}\n\n/**\n * Checks if the hostname is allowed.\n * @param hostname - The hostname to check.\n * @param allowedHosts - A set of allowed hostnames.\n * @returns `true` if the hostname is allowed, `false` otherwise.\n */\nfunction isHostAllowed(hostname: string, allowedHosts: ReadonlySet<string>): boolean {\n if (allowedHosts.has('*') || allowedHosts.has(hostname)) {\n return true;\n }\n\n for (const allowedHost of allowedHosts) {\n if (!allowedHost.startsWith('*.')) {\n continue;\n }\n\n const domain = allowedHost.slice(1);\n if (hostname.endsWith(domain)) {\n return true;\n }\n }\n\n return false;\n}\n\n/**\n * Validates the headers of an incoming request.\n *\n * @param request - The incoming `Request` object containing the headers to validate.\n * @param allowedHosts - A set of allowed hostnames.\n * @param disableHostCheck - Whether to disable the host check.\n * @throws Error if any of the validated headers contain invalid values.\n */\nfunction validateHeaders(\n request: Request,\n allowedHosts: ReadonlySet<string>,\n disableHostCheck: boolean,\n): void {\n const headers = request.headers;\n for (const headerName of HOST_HEADERS_TO_VALIDATE) {\n const headerValue = getFirstHeaderValue(headers.get(headerName));\n if (headerValue && !disableHostCheck) {\n verifyHostAllowed(headerName, headerValue, allowedHosts);\n }\n }\n\n const xForwardedPort = getFirstHeaderValue(headers.get('x-forwarded-port'));\n if (xForwardedPort && !VALID_PORT_REGEX.test(xForwardedPort)) {\n throw new Error('Header \"x-forwarded-port\" must be a numeric value.');\n }\n\n const xForwardedProto = getFirstHeaderValue(headers.get('x-forwarded-proto'));\n if (xForwardedProto && !VALID_PROTO_REGEX.test(xForwardedProto)) {\n throw new Error('Header \"x-forwarded-proto\" must be either \"http\" or \"https\".');\n }\n\n const xForwardedPrefix = getFirstHeaderValue(headers.get('x-forwarded-prefix'));\n if (xForwardedPrefix && !VALID_PREFIX_REGEX.test(xForwardedPrefix)) {\n throw new Error(\n 'Header \"x-forwarded-prefix\" is invalid. It must start with a \"/\" and contain ' +\n 'only alphanumeric characters, hyphens, and underscores, separated by single slashes.',\n );\n }\n}\n\n/**\n * Checks if a specific proxy header is allowed.\n *\n * @param headerName - The name of the proxy header to check.\n * @param trustProxyHeaders - A set of allowed proxy headers.\n * @returns `true` if the header is allowed, `false` otherwise.\n */\nexport function isProxyHeaderAllowed(\n headerName: string,\n trustProxyHeaders: ReadonlySet<string>,\n): boolean {\n return trustProxyHeaders.has(headerName.toLowerCase());\n}\n\n/**\n * Normalizes the `trustProxyHeaders` option to a consistent representation.\n * @param trustProxyHeaders The input `trustProxyHeaders` value.\n * @returns A `Set<string>` of normalized header names.\n */\nexport function normalizeTrustProxyHeaders(\n trustProxyHeaders: boolean | readonly string[] | undefined,\n): ReadonlySet<string> {\n if (!trustProxyHeaders) {\n return new Set();\n }\n\n if (trustProxyHeaders === true) {\n return X_FORWARDED_HEADERS;\n }\n\n return new Set(trustProxyHeaders.map((h) => h.toLowerCase()));\n}\n"],"names":["X_FORWARDED_HEADERS","Set","HOST_HEADERS_TO_VALIDATE","VALID_PORT_REGEX","VALID_PROTO_REGEX","VALID_PREFIX_REGEX","getFirstHeaderValue","value","toString","split","trim","validateRequest","request","allowedHosts","disableHostCheck","validateHeaders","validateUrl","URL","url","hostname","isHostAllowed","Error","sanitizeRequestHeaders","trustProxyHeaders","headersDeleted","headers","Headers","key","lowerKey","toLowerCase","startsWith","isProxyHeaderAllowed","console","warn","set","Request","clone","signal","verifyHostAllowed","headerName","headerValue","canParse","pathname","search","hash","username","password","has","allowedHost","domain","slice","endsWith","get","xForwardedPort","test","xForwardedProto","xForwardedPrefix","normalizeTrustProxyHeaders","map","h"],"mappings":"AAWA,MAAMA,mBAAmB,GAAwB,IAAIC,GAAG,CAAC,CACvD,iBAAiB,EACjB,kBAAkB,EAClB,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,CACrB,CAAC;AAKF,MAAMC,wBAAwB,GAA0B,CAAC,MAAM,EAAE,kBAAkB,CAAC;AAKpF,MAAMC,gBAAgB,GAAG,OAAO;AAKhC,MAAMC,iBAAiB,GAAG,WAAW;AAMrC,MAAMC,kBAAkB,GAAG,kCAAkC;AAgBvD,SAAUC,mBAAmBA,CACjCC,KAA2C,EAAA;AAE3C,EAAA,OAAOA,KAAK,EAAEC,QAAQ,EAAE,CAACC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAEC,IAAI,EAAE;AACnD;SAUgBC,eAAeA,CAC7BC,OAAgB,EAChBC,YAAiC,EACjCC,gBAAyB,EAAA;AAEzBC,EAAAA,eAAe,CAACH,OAAO,EAAEC,YAAY,EAAEC,gBAAgB,CAAC;EAExD,IAAI,CAACA,gBAAgB,EAAE;IACrBE,WAAW,CAAC,IAAIC,GAAG,CAACL,OAAO,CAACM,GAAG,CAAC,EAAEL,YAAY,CAAC;AACjD,EAAA;AACF;AASM,SAAUG,WAAWA,CAACE,GAAQ,EAAEL,YAAiC,EAAA;EACrE,MAAM;AAAEM,IAAAA;AAAQ,GAAE,GAAGD,GAAG;AACxB,EAAA,IAAI,CAACE,aAAa,CAACD,QAAQ,EAAEN,YAAY,CAAC,EAAE;AAC1C,IAAA,MAAM,IAAIQ,KAAK,CAAC,CAAA,mBAAA,EAAsBF,QAAQ,mBAAmB,CAAC;AACpE,EAAA;AACF;AAUM,SAAUG,sBAAsBA,CACpCV,OAAgB,EAChBW,iBAAsC,EAAA;EAEtC,IAAIC,cAAc,GAAG,KAAK;AAC1B,EAAA,MAAMC,OAAO,GAAG,IAAIC,OAAO,EAAE;EAE7B,KAAK,MAAM,CAACC,GAAG,EAAEpB,KAAK,CAAC,IAAIK,OAAO,CAACa,OAAO,EAAE;AAC1C,IAAA,MAAMG,QAAQ,GAAGD,GAAG,CAACE,WAAW,EAAE;AAClC,IAAA,IAAID,QAAQ,CAACE,UAAU,CAAC,cAAc,CAAC,IAAI,CAACC,oBAAoB,CAACH,QAAQ,EAAEL,iBAAiB,CAAC,EAAE;MAE7FS,OAAO,CAACC,IAAI,CACV,CAAA,UAAA,EAAaN,GAAG,CAAA,8DAAA,CAAgE,GAC9E,yGAAyG,CAC5G;AACDH,MAAAA,cAAc,GAAG,IAAI;AACvB,IAAA,CAAA,MAAO;AACLC,MAAAA,OAAO,CAACS,GAAG,CAACP,GAAG,EAAEpB,KAAK,CAAC;AACzB,IAAA;AACF,EAAA;EAEA,OAAOiB,cAAA,GACH,IAAIW,OAAO,CAACvB,OAAO,CAACwB,KAAK,EAAE,EAAE;IAC3BC,MAAM,EAAEzB,OAAO,CAACyB,MAAM;AACtBZ,IAAAA;GACD,CAAA,GACDb,OAAO;AACb;AAUA,SAAS0B,iBAAiBA,CACxBC,UAAkB,EAClBC,WAAmB,EACnB3B,YAAiC,EAAA;AAEjC,EAAA,MAAMK,GAAG,GAAG,CAAA,OAAA,EAAUsB,WAAW,CAAA,CAAE;AACnC,EAAA,IAAI,CAACvB,GAAG,CAACwB,QAAQ,CAACvB,GAAG,CAAC,EAAE;AACtB,IAAA,MAAM,IAAIG,KAAK,CAAC,CAAA,QAAA,EAAWkB,UAAU,mDAAmD,CAAC;AAC3F,EAAA;EAEA,MAAM;IAAEpB,QAAQ;IAAEuB,QAAQ;IAAEC,MAAM;IAAEC,IAAI;IAAEC,QAAQ;AAAEC,IAAAA;GAAU,GAAG,IAAI7B,GAAG,CAACC,GAAG,CAAC;EAC7E,IAAIwB,QAAQ,KAAK,GAAG,IAAIC,MAAM,IAAIC,IAAI,IAAIC,QAAQ,IAAIC,QAAQ,EAAE;IAC9D,MAAM,IAAIzB,KAAK,CACb,CAAA,QAAA,EAAWkB,UAAU,CAAA,cAAA,EAAiBC,WAAW,6CAA6C,CAC/F;AACH,EAAA;AAEA,EAAA,IAAI,CAACpB,aAAa,CAACD,QAAQ,EAAEN,YAAY,CAAC,EAAE;IAC1C,MAAM,IAAIQ,KAAK,CAAC,CAAA,QAAA,EAAWkB,UAAU,CAAA,cAAA,EAAiBC,WAAW,mBAAmB,CAAC;AACvF,EAAA;AACF;AAQA,SAASpB,aAAaA,CAACD,QAAgB,EAAEN,YAAiC,EAAA;AACxE,EAAA,IAAIA,YAAY,CAACkC,GAAG,CAAC,GAAG,CAAC,IAAIlC,YAAY,CAACkC,GAAG,CAAC5B,QAAQ,CAAC,EAAE;AACvD,IAAA,OAAO,IAAI;AACb,EAAA;AAEA,EAAA,KAAK,MAAM6B,WAAW,IAAInC,YAAY,EAAE;AACtC,IAAA,IAAI,CAACmC,WAAW,CAAClB,UAAU,CAAC,IAAI,CAAC,EAAE;AACjC,MAAA;AACF,IAAA;AAEA,IAAA,MAAMmB,MAAM,GAAGD,WAAW,CAACE,KAAK,CAAC,CAAC,CAAC;AACnC,IAAA,IAAI/B,QAAQ,CAACgC,QAAQ,CAACF,MAAM,CAAC,EAAE;AAC7B,MAAA,OAAO,IAAI;AACb,IAAA;AACF,EAAA;AAEA,EAAA,OAAO,KAAK;AACd;AAUA,SAASlC,eAAeA,CACtBH,OAAgB,EAChBC,YAAiC,EACjCC,gBAAyB,EAAA;AAEzB,EAAA,MAAMW,OAAO,GAAGb,OAAO,CAACa,OAAO;AAC/B,EAAA,KAAK,MAAMc,UAAU,IAAIrC,wBAAwB,EAAE;IACjD,MAAMsC,WAAW,GAAGlC,mBAAmB,CAACmB,OAAO,CAAC2B,GAAG,CAACb,UAAU,CAAC,CAAC;AAChE,IAAA,IAAIC,WAAW,IAAI,CAAC1B,gBAAgB,EAAE;AACpCwB,MAAAA,iBAAiB,CAACC,UAAU,EAAEC,WAAW,EAAE3B,YAAY,CAAC;AAC1D,IAAA;AACF,EAAA;EAEA,MAAMwC,cAAc,GAAG/C,mBAAmB,CAACmB,OAAO,CAAC2B,GAAG,CAAC,kBAAkB,CAAC,CAAC;EAC3E,IAAIC,cAAc,IAAI,CAAClD,gBAAgB,CAACmD,IAAI,CAACD,cAAc,CAAC,EAAE;AAC5D,IAAA,MAAM,IAAIhC,KAAK,CAAC,oDAAoD,CAAC;AACvE,EAAA;EAEA,MAAMkC,eAAe,GAAGjD,mBAAmB,CAACmB,OAAO,CAAC2B,GAAG,CAAC,mBAAmB,CAAC,CAAC;EAC7E,IAAIG,eAAe,IAAI,CAACnD,iBAAiB,CAACkD,IAAI,CAACC,eAAe,CAAC,EAAE;AAC/D,IAAA,MAAM,IAAIlC,KAAK,CAAC,8DAA8D,CAAC;AACjF,EAAA;EAEA,MAAMmC,gBAAgB,GAAGlD,mBAAmB,CAACmB,OAAO,CAAC2B,GAAG,CAAC,oBAAoB,CAAC,CAAC;EAC/E,IAAII,gBAAgB,IAAI,CAACnD,kBAAkB,CAACiD,IAAI,CAACE,gBAAgB,CAAC,EAAE;AAClE,IAAA,MAAM,IAAInC,KAAK,CACb,+EAA+E,GAC7E,sFAAsF,CACzF;AACH,EAAA;AACF;AASM,SAAUU,oBAAoBA,CAClCQ,UAAkB,EAClBhB,iBAAsC,EAAA;EAEtC,OAAOA,iBAAiB,CAACwB,GAAG,CAACR,UAAU,CAACV,WAAW,EAAE,CAAC;AACxD;AAOM,SAAU4B,0BAA0BA,CACxClC,iBAA0D,EAAA;EAE1D,IAAI,CAACA,iBAAiB,EAAE;IACtB,OAAO,IAAItB,GAAG,EAAE;AAClB,EAAA;EAEA,IAAIsB,iBAAiB,KAAK,IAAI,EAAE;AAC9B,IAAA,OAAOvB,mBAAmB;AAC5B,EAAA;AAEA,EAAA,OAAO,IAAIC,GAAG,CAACsB,iBAAiB,CAACmC,GAAG,CAAEC,CAAC,IAAKA,CAAC,CAAC9B,WAAW,EAAE,CAAC,CAAC;AAC/D;;;;"}
|
|
1
|
+
{"version":3,"file":"_validation-chunk.mjs","sources":["../../../../../../darwin_arm64-fastbuild-ST-fdfa778d11ba/bin/packages/angular/ssr/src/utils/validation.ts"],"sourcesContent":["/**\n * @license\n * Copyright Google LLC All Rights Reserved.\n *\n * Use of this source code is governed by an MIT-style license that can be\n * found in the LICENSE file at https://angular.dev/license\n */\n\n/**\n * Internal sentinel string representing a wildcard rule to trust all proxy headers.\n */\nconst TRUST_ALL_PROXY_HEADERS = '*';\n\n/**\n * The set of headers that should be validated for host header injection attacks.\n */\nconst HOST_HEADERS_TO_VALIDATE: ReadonlyArray<string> = ['host', 'x-forwarded-host'];\n\n/**\n * Regular expression to validate that the port is a numeric value.\n */\nconst VALID_PORT_REGEX = /^\\d+$/;\n\n/**\n * Regular expression to validate that the protocol is either http or https (case-insensitive).\n */\nconst VALID_PROTO_REGEX = /^https?$/i;\n\n/**\n * Regular expression to validate that the prefix is valid. Validates that the prefix is a valid path prefix and nothing else.\n * It validates that the prefix starts with a forward slash and contains only letters, numbers, hyphens, underscores and forward slashes.\n */\nconst VALID_PREFIX_REGEX = /^\\/([a-z0-9_-]+\\/)*[a-z0-9_-]*$/i;\n\n/**\n * Extracts the first value from a multi-value header string.\n *\n * @param value - A string or an array of strings representing the header values.\n * If it's a string, values are expected to be comma-separated.\n * @returns The first trimmed value from the multi-value header, or `undefined` if the input is invalid or empty.\n *\n * @example\n * ```typescript\n * getFirstHeaderValue(\"value1, value2, value3\"); // \"value1\"\n * getFirstHeaderValue([\"value1\", \"value2\"]); // \"value1\"\n * getFirstHeaderValue(undefined); // undefined\n * ```\n */\nexport function getFirstHeaderValue(\n value: string | string[] | undefined | null,\n): string | undefined {\n return value?.toString().split(',', 1)[0]?.trim();\n}\n\n/**\n * Validates a request.\n *\n * @param request - The incoming `Request` object to validate.\n * @param allowedHosts - A set of allowed hostnames.\n * @param disableHostCheck - Whether to disable the host check.\n * @throws Error if any of the validated headers contain invalid values.\n */\nexport function validateRequest(\n request: Request,\n allowedHosts: ReadonlySet<string>,\n disableHostCheck: boolean,\n): void {\n validateHeaders(request, allowedHosts, disableHostCheck);\n\n if (!disableHostCheck) {\n validateUrl(new URL(request.url), allowedHosts);\n }\n}\n\n/**\n * Validates that the hostname of a given URL is allowed.\n *\n * @param url - The URL object to validate.\n * @param allowedHosts - A set of allowed hostnames.\n * @throws Error if the hostname is not in the allowlist.\n */\nexport function validateUrl(url: URL, allowedHosts: ReadonlySet<string>): void {\n const { hostname } = url;\n if (!isHostAllowed(hostname, allowedHosts)) {\n throw new Error(`URL with hostname \"${hostname}\" is not allowed.`);\n }\n}\n\n/**\n * Sanitizes the proxy headers of a request by removing unallowed `X-Forwarded-*` headers.\n * If no headers need to be removed, the original request is returned without cloning.\n *\n * @param request - The incoming `Request` object to sanitize.\n * @param trustProxyHeaders - A set of allowed proxy headers.\n * @returns The sanitized request, or the original request if no changes were needed.\n */\nexport function sanitizeRequestHeaders(\n request: Request,\n trustProxyHeaders: ReadonlySet<string>,\n): Request {\n let headersDeleted = false;\n const headers = new Headers();\n\n for (const [key, value] of request.headers) {\n const lowerKey = key.toLowerCase();\n if (lowerKey.startsWith('x-forwarded-') && !isProxyHeaderAllowed(lowerKey, trustProxyHeaders)) {\n // eslint-disable-next-line no-console\n console.warn(\n `Received \"${key}\" header but \"trustProxyHeaders\" was not set up to allow it.\\n` +\n `For more information, see https://angular.dev/best-practices/security#configuring-trusted-proxy-headers`,\n );\n headersDeleted = true;\n } else {\n headers.set(key, value);\n }\n }\n\n return headersDeleted\n ? new Request(request.clone(), {\n signal: request.signal,\n headers,\n })\n : request;\n}\n\n/**\n * Validates a specific host header value against the allowed hosts.\n *\n * @param headerName - The name of the header to validate (e.g., 'host', 'x-forwarded-host').\n * @param headerValue - The value of the header to validate.\n * @param allowedHosts - A set of allowed hostnames.\n * @throws Error if the header value is invalid or the hostname is not in the allowlist.\n */\nfunction verifyHostAllowed(\n headerName: string,\n headerValue: string,\n allowedHosts: ReadonlySet<string>,\n): void {\n const url = `http://${headerValue}`;\n if (!URL.canParse(url)) {\n throw new Error(`Header \"${headerName}\" contains an invalid value and cannot be parsed.`);\n }\n\n const { hostname, pathname, search, hash, username, password } = new URL(url);\n if (pathname !== '/' || search || hash || username || password) {\n throw new Error(\n `Header \"${headerName}\" with value \"${headerValue}\" contains characters that are not allowed.`,\n );\n }\n\n if (!isHostAllowed(hostname, allowedHosts)) {\n throw new Error(`Header \"${headerName}\" with value \"${headerValue}\" is not allowed.`);\n }\n}\n\n/**\n * Checks if the hostname is allowed.\n * @param hostname - The hostname to check.\n * @param allowedHosts - A set of allowed hostnames.\n * @returns `true` if the hostname is allowed, `false` otherwise.\n */\nfunction isHostAllowed(hostname: string, allowedHosts: ReadonlySet<string>): boolean {\n if (allowedHosts.has('*') || allowedHosts.has(hostname)) {\n return true;\n }\n\n for (const allowedHost of allowedHosts) {\n if (!allowedHost.startsWith('*.')) {\n continue;\n }\n\n const domain = allowedHost.slice(1);\n if (hostname.endsWith(domain)) {\n return true;\n }\n }\n\n return false;\n}\n\n/**\n * Validates the headers of an incoming request.\n *\n * @param request - The incoming `Request` object containing the headers to validate.\n * @param allowedHosts - A set of allowed hostnames.\n * @param disableHostCheck - Whether to disable the host check.\n * @throws Error if any of the validated headers contain invalid values.\n */\nfunction validateHeaders(\n request: Request,\n allowedHosts: ReadonlySet<string>,\n disableHostCheck: boolean,\n): void {\n const headers = request.headers;\n for (const headerName of HOST_HEADERS_TO_VALIDATE) {\n const headerValue = getFirstHeaderValue(headers.get(headerName));\n if (headerValue && !disableHostCheck) {\n verifyHostAllowed(headerName, headerValue, allowedHosts);\n }\n }\n\n const xForwardedPort = getFirstHeaderValue(headers.get('x-forwarded-port'));\n if (xForwardedPort && !VALID_PORT_REGEX.test(xForwardedPort)) {\n throw new Error('Header \"x-forwarded-port\" must be a numeric value.');\n }\n\n const xForwardedProto = getFirstHeaderValue(headers.get('x-forwarded-proto'));\n if (xForwardedProto && !VALID_PROTO_REGEX.test(xForwardedProto)) {\n throw new Error('Header \"x-forwarded-proto\" must be either \"http\" or \"https\".');\n }\n\n const xForwardedPrefix = getFirstHeaderValue(headers.get('x-forwarded-prefix'));\n if (xForwardedPrefix && !VALID_PREFIX_REGEX.test(xForwardedPrefix)) {\n throw new Error(\n 'Header \"x-forwarded-prefix\" is invalid. It must start with a \"/\" and contain ' +\n 'only alphanumeric characters, hyphens, and underscores, separated by single slashes.',\n );\n }\n}\n\n/**\n * Checks if a specific proxy header is allowed.\n *\n * @param headerName - The name of the proxy header to check.\n * @param trustProxyHeaders - A set of allowed proxy headers.\n * @returns `true` if the header is allowed, `false` otherwise.\n */\nexport function isProxyHeaderAllowed(\n headerName: string,\n trustProxyHeaders: ReadonlySet<string>,\n): boolean {\n return (\n trustProxyHeaders.has(TRUST_ALL_PROXY_HEADERS) ||\n trustProxyHeaders.has(headerName.toLowerCase())\n );\n}\n\n/**\n * Normalizes the `trustProxyHeaders` option to a consistent representation.\n * @param trustProxyHeaders The input `trustProxyHeaders` value.\n * @returns A `Set<string>` of normalized header names.\n */\nexport function normalizeTrustProxyHeaders(\n trustProxyHeaders: boolean | readonly string[] | undefined,\n): ReadonlySet<string> {\n if (!trustProxyHeaders) {\n return new Set();\n }\n\n if (trustProxyHeaders === true) {\n return new Set([TRUST_ALL_PROXY_HEADERS]);\n }\n\n const normalizedTrustedProxyHeaders = new Set(trustProxyHeaders.map((h) => h.toLowerCase()));\n if (normalizedTrustedProxyHeaders.has(TRUST_ALL_PROXY_HEADERS)) {\n throw new Error(\n `\"${TRUST_ALL_PROXY_HEADERS}\" is not allowed as a value for the \"trustProxyHeaders\" option.`,\n );\n }\n\n return normalizedTrustedProxyHeaders;\n}\n"],"names":["TRUST_ALL_PROXY_HEADERS","HOST_HEADERS_TO_VALIDATE","VALID_PORT_REGEX","VALID_PROTO_REGEX","VALID_PREFIX_REGEX","getFirstHeaderValue","value","toString","split","trim","validateRequest","request","allowedHosts","disableHostCheck","validateHeaders","validateUrl","URL","url","hostname","isHostAllowed","Error","sanitizeRequestHeaders","trustProxyHeaders","headersDeleted","headers","Headers","key","lowerKey","toLowerCase","startsWith","isProxyHeaderAllowed","console","warn","set","Request","clone","signal","verifyHostAllowed","headerName","headerValue","canParse","pathname","search","hash","username","password","has","allowedHost","domain","slice","endsWith","get","xForwardedPort","test","xForwardedProto","xForwardedPrefix","normalizeTrustProxyHeaders","Set","normalizedTrustedProxyHeaders","map","h"],"mappings":"AAWA,MAAMA,uBAAuB,GAAG,GAAG;AAKnC,MAAMC,wBAAwB,GAA0B,CAAC,MAAM,EAAE,kBAAkB,CAAC;AAKpF,MAAMC,gBAAgB,GAAG,OAAO;AAKhC,MAAMC,iBAAiB,GAAG,WAAW;AAMrC,MAAMC,kBAAkB,GAAG,kCAAkC;AAgBvD,SAAUC,mBAAmBA,CACjCC,KAA2C,EAAA;AAE3C,EAAA,OAAOA,KAAK,EAAEC,QAAQ,EAAE,CAACC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAEC,IAAI,EAAE;AACnD;SAUgBC,eAAeA,CAC7BC,OAAgB,EAChBC,YAAiC,EACjCC,gBAAyB,EAAA;AAEzBC,EAAAA,eAAe,CAACH,OAAO,EAAEC,YAAY,EAAEC,gBAAgB,CAAC;EAExD,IAAI,CAACA,gBAAgB,EAAE;IACrBE,WAAW,CAAC,IAAIC,GAAG,CAACL,OAAO,CAACM,GAAG,CAAC,EAAEL,YAAY,CAAC;AACjD,EAAA;AACF;AASM,SAAUG,WAAWA,CAACE,GAAQ,EAAEL,YAAiC,EAAA;EACrE,MAAM;AAAEM,IAAAA;AAAQ,GAAE,GAAGD,GAAG;AACxB,EAAA,IAAI,CAACE,aAAa,CAACD,QAAQ,EAAEN,YAAY,CAAC,EAAE;AAC1C,IAAA,MAAM,IAAIQ,KAAK,CAAC,CAAA,mBAAA,EAAsBF,QAAQ,mBAAmB,CAAC;AACpE,EAAA;AACF;AAUM,SAAUG,sBAAsBA,CACpCV,OAAgB,EAChBW,iBAAsC,EAAA;EAEtC,IAAIC,cAAc,GAAG,KAAK;AAC1B,EAAA,MAAMC,OAAO,GAAG,IAAIC,OAAO,EAAE;EAE7B,KAAK,MAAM,CAACC,GAAG,EAAEpB,KAAK,CAAC,IAAIK,OAAO,CAACa,OAAO,EAAE;AAC1C,IAAA,MAAMG,QAAQ,GAAGD,GAAG,CAACE,WAAW,EAAE;AAClC,IAAA,IAAID,QAAQ,CAACE,UAAU,CAAC,cAAc,CAAC,IAAI,CAACC,oBAAoB,CAACH,QAAQ,EAAEL,iBAAiB,CAAC,EAAE;MAE7FS,OAAO,CAACC,IAAI,CACV,CAAA,UAAA,EAAaN,GAAG,CAAA,8DAAA,CAAgE,GAC9E,yGAAyG,CAC5G;AACDH,MAAAA,cAAc,GAAG,IAAI;AACvB,IAAA,CAAA,MAAO;AACLC,MAAAA,OAAO,CAACS,GAAG,CAACP,GAAG,EAAEpB,KAAK,CAAC;AACzB,IAAA;AACF,EAAA;EAEA,OAAOiB,cAAA,GACH,IAAIW,OAAO,CAACvB,OAAO,CAACwB,KAAK,EAAE,EAAE;IAC3BC,MAAM,EAAEzB,OAAO,CAACyB,MAAM;AACtBZ,IAAAA;GACD,CAAA,GACDb,OAAO;AACb;AAUA,SAAS0B,iBAAiBA,CACxBC,UAAkB,EAClBC,WAAmB,EACnB3B,YAAiC,EAAA;AAEjC,EAAA,MAAMK,GAAG,GAAG,CAAA,OAAA,EAAUsB,WAAW,CAAA,CAAE;AACnC,EAAA,IAAI,CAACvB,GAAG,CAACwB,QAAQ,CAACvB,GAAG,CAAC,EAAE;AACtB,IAAA,MAAM,IAAIG,KAAK,CAAC,CAAA,QAAA,EAAWkB,UAAU,mDAAmD,CAAC;AAC3F,EAAA;EAEA,MAAM;IAAEpB,QAAQ;IAAEuB,QAAQ;IAAEC,MAAM;IAAEC,IAAI;IAAEC,QAAQ;AAAEC,IAAAA;GAAU,GAAG,IAAI7B,GAAG,CAACC,GAAG,CAAC;EAC7E,IAAIwB,QAAQ,KAAK,GAAG,IAAIC,MAAM,IAAIC,IAAI,IAAIC,QAAQ,IAAIC,QAAQ,EAAE;IAC9D,MAAM,IAAIzB,KAAK,CACb,CAAA,QAAA,EAAWkB,UAAU,CAAA,cAAA,EAAiBC,WAAW,6CAA6C,CAC/F;AACH,EAAA;AAEA,EAAA,IAAI,CAACpB,aAAa,CAACD,QAAQ,EAAEN,YAAY,CAAC,EAAE;IAC1C,MAAM,IAAIQ,KAAK,CAAC,CAAA,QAAA,EAAWkB,UAAU,CAAA,cAAA,EAAiBC,WAAW,mBAAmB,CAAC;AACvF,EAAA;AACF;AAQA,SAASpB,aAAaA,CAACD,QAAgB,EAAEN,YAAiC,EAAA;AACxE,EAAA,IAAIA,YAAY,CAACkC,GAAG,CAAC,GAAG,CAAC,IAAIlC,YAAY,CAACkC,GAAG,CAAC5B,QAAQ,CAAC,EAAE;AACvD,IAAA,OAAO,IAAI;AACb,EAAA;AAEA,EAAA,KAAK,MAAM6B,WAAW,IAAInC,YAAY,EAAE;AACtC,IAAA,IAAI,CAACmC,WAAW,CAAClB,UAAU,CAAC,IAAI,CAAC,EAAE;AACjC,MAAA;AACF,IAAA;AAEA,IAAA,MAAMmB,MAAM,GAAGD,WAAW,CAACE,KAAK,CAAC,CAAC,CAAC;AACnC,IAAA,IAAI/B,QAAQ,CAACgC,QAAQ,CAACF,MAAM,CAAC,EAAE;AAC7B,MAAA,OAAO,IAAI;AACb,IAAA;AACF,EAAA;AAEA,EAAA,OAAO,KAAK;AACd;AAUA,SAASlC,eAAeA,CACtBH,OAAgB,EAChBC,YAAiC,EACjCC,gBAAyB,EAAA;AAEzB,EAAA,MAAMW,OAAO,GAAGb,OAAO,CAACa,OAAO;AAC/B,EAAA,KAAK,MAAMc,UAAU,IAAIrC,wBAAwB,EAAE;IACjD,MAAMsC,WAAW,GAAGlC,mBAAmB,CAACmB,OAAO,CAAC2B,GAAG,CAACb,UAAU,CAAC,CAAC;AAChE,IAAA,IAAIC,WAAW,IAAI,CAAC1B,gBAAgB,EAAE;AACpCwB,MAAAA,iBAAiB,CAACC,UAAU,EAAEC,WAAW,EAAE3B,YAAY,CAAC;AAC1D,IAAA;AACF,EAAA;EAEA,MAAMwC,cAAc,GAAG/C,mBAAmB,CAACmB,OAAO,CAAC2B,GAAG,CAAC,kBAAkB,CAAC,CAAC;EAC3E,IAAIC,cAAc,IAAI,CAAClD,gBAAgB,CAACmD,IAAI,CAACD,cAAc,CAAC,EAAE;AAC5D,IAAA,MAAM,IAAIhC,KAAK,CAAC,oDAAoD,CAAC;AACvE,EAAA;EAEA,MAAMkC,eAAe,GAAGjD,mBAAmB,CAACmB,OAAO,CAAC2B,GAAG,CAAC,mBAAmB,CAAC,CAAC;EAC7E,IAAIG,eAAe,IAAI,CAACnD,iBAAiB,CAACkD,IAAI,CAACC,eAAe,CAAC,EAAE;AAC/D,IAAA,MAAM,IAAIlC,KAAK,CAAC,8DAA8D,CAAC;AACjF,EAAA;EAEA,MAAMmC,gBAAgB,GAAGlD,mBAAmB,CAACmB,OAAO,CAAC2B,GAAG,CAAC,oBAAoB,CAAC,CAAC;EAC/E,IAAII,gBAAgB,IAAI,CAACnD,kBAAkB,CAACiD,IAAI,CAACE,gBAAgB,CAAC,EAAE;AAClE,IAAA,MAAM,IAAInC,KAAK,CACb,+EAA+E,GAC7E,sFAAsF,CACzF;AACH,EAAA;AACF;AASM,SAAUU,oBAAoBA,CAClCQ,UAAkB,EAClBhB,iBAAsC,EAAA;AAEtC,EAAA,OACEA,iBAAiB,CAACwB,GAAG,CAAC9C,uBAAuB,CAAC,IAC9CsB,iBAAiB,CAACwB,GAAG,CAACR,UAAU,CAACV,WAAW,EAAE,CAAC;AAEnD;AAOM,SAAU4B,0BAA0BA,CACxClC,iBAA0D,EAAA;EAE1D,IAAI,CAACA,iBAAiB,EAAE;IACtB,OAAO,IAAImC,GAAG,EAAE;AAClB,EAAA;EAEA,IAAInC,iBAAiB,KAAK,IAAI,EAAE;AAC9B,IAAA,OAAO,IAAImC,GAAG,CAAC,CAACzD,uBAAuB,CAAC,CAAC;AAC3C,EAAA;AAEA,EAAA,MAAM0D,6BAA6B,GAAG,IAAID,GAAG,CAACnC,iBAAiB,CAACqC,GAAG,CAAEC,CAAC,IAAKA,CAAC,CAAChC,WAAW,EAAE,CAAC,CAAC;AAC5F,EAAA,IAAI8B,6BAA6B,CAACZ,GAAG,CAAC9C,uBAAuB,CAAC,EAAE;AAC9D,IAAA,MAAM,IAAIoB,KAAK,CACb,CAAA,CAAA,EAAIpB,uBAAuB,iEAAiE,CAC7F;AACH,EAAA;AAEA,EAAA,OAAO0D,6BAA6B;AACtC;;;;"}
|
package/fesm2022/ssr.mjs
CHANGED
|
@@ -426,7 +426,8 @@ const IS_DISCOVERING_ROUTES = new InjectionToken(typeof ngDevMode === 'undefined
|
|
|
426
426
|
});
|
|
427
427
|
const MODULE_PRELOAD_MAX = 10;
|
|
428
428
|
const CATCH_ALL_REGEXP = /\/(\*\*)$/;
|
|
429
|
-
const URL_PARAMETER_REGEXP = /(?<!\\):([^/]+)
|
|
429
|
+
const URL_PARAMETER_REGEXP = /(?<!\\):([^/]+)/;
|
|
430
|
+
const URL_PARAMETER_GLOBAL_REGEXP = new RegExp(URL_PARAMETER_REGEXP, 'g');
|
|
430
431
|
async function* handleRoute(options) {
|
|
431
432
|
try {
|
|
432
433
|
const {
|
|
@@ -644,7 +645,7 @@ async function* handleSSGRoute(serverConfigRouteTree, redirectTo, metadata, pare
|
|
|
644
645
|
try {
|
|
645
646
|
for (const params of parameters) {
|
|
646
647
|
const replacer = handlePrerenderParamsReplacement(params, currentRoutePath);
|
|
647
|
-
const routeWithResolvedParams = currentRoutePath.replace(
|
|
648
|
+
const routeWithResolvedParams = currentRoutePath.replace(URL_PARAMETER_GLOBAL_REGEXP, replacer).replace(CATCH_ALL_REGEXP, replacer);
|
|
648
649
|
yield {
|
|
649
650
|
...meta,
|
|
650
651
|
route: routeWithResolvedParams,
|