@fundamental-ngx/cdk 0.65.1-rc.0 → 0.65.1-rc.2

package/fesm2022/fundamental-ngx-cdk-utils.mjs

@@ -7039,14 +7039,41 @@ class SafePipe {
                 return this.sanitizer.bypassSecurityTrustStyle(value);
             case 'script':
                 return this.sanitizer.bypassSecurityTrustScript(value);
-            case 'url':
+            case 'url': {
+                if (!this._isSafeUrl(value)) {
+                    return this.sanitizer.bypassSecurityTrustUrl('');
+                }
                 return this.sanitizer.bypassSecurityTrustUrl(value);
+            }
             case 'resourceUrl':
                 return this.sanitizer.bypassSecurityTrustResourceUrl(value);
             default:
                 throw new Error(`Invalid safe type specified: ${type}`);
         }
     }
+    /**
+     * @hidden
+     *
+     * Browsers strip ASCII tab/newline characters from the whole URL before parsing, so a
+     * value like `java\tscript:...` must not evade scheme detection. Any URL containing C0
+     * control characters is rejected outright — legitimate URLs never contain them.
+     */
+    _isSafeUrl(value) {
+        if (value == null) {
+            return false;
+        }
+        const str = String(value).trim();
+        if (str === '') {
+            return true;
+        }
+        if (Array.from(str).some((ch) => ch.charCodeAt(0) < 32 || ch.charCodeAt(0) === 127)) {
+            return false;
+        }
+        if (!/^[a-z][a-z0-9+.-]*:/i.test(str)) {
+            return true;
+        }
+        return /^(https?|mailto|tel):/i.test(str);
+    }
     static { this.ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.2.1", ngImport: i0, type: SafePipe, deps: [{ token: i1$4.DomSanitizer }], target: i0.ɵɵFactoryTarget.Pipe }); }
     static { this.ɵpipe = i0.ɵɵngDeclarePipe({ minVersion: "14.0.0", version: "22.2.1", ngImport: i0, type: SafePipe, isStandalone: true, name: "safe" }); }
 }