You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
This repository was archived by the owner on Apr 12, 2024. It is now read-only.
fix(security): do not auto-bootstrap when loaded from an extension.
Extension URIs (`resource://...`) bypass Content-Security-Policy in Chrome and
Firefox and can always be loaded. Now if a site already has a XSS bug, and uses
CSP to protect itself, but the user has an extension installed that uses
Angular, an attacked can load Angular from the extension, and Angular's
auto-bootstrapping can be used to bypass the victim site's CSP protection.
Notes:
- `isAutoBootstrapAllowed` must be initialized on load, so that `currentScript`
is set correctly.
- The tests are a bit indirect as reproducing the actual scenario is too
complicated to reproduce (requires signing an extension etc). I have confirmed
this to be working manually.
Closes#15346
0 commit comments