fixup! fix(core): sanitize meta selectors

JeanMeche · JeanMeche · commit c2dcf4e52ac6 · 2026-05-21T03:02:50.000+02:00
diff --git a/packages/platform-browser/src/browser/meta.ts b/packages/platform-browser/src/browser/meta.ts
@@ -102,7 +102,8 @@ export class Meta {
    */
   getTag(attrSelector: string): HTMLMetaElement | null {
     if (!attrSelector) return null;
-    return this._doc.querySelector(`meta[${attrSelector}]`) || null;
+    const meta = this._doc.querySelector(`meta[${attrSelector}]`);
+    return meta?.nodeName.toLowerCase() === 'meta' ? meta : null;
   }
 
   /**
@@ -114,7 +115,11 @@ export class Meta {
   getTags(attrSelector: string): HTMLMetaElement[] {
     if (!attrSelector) return [];
     const list /*NodeList*/ = this._doc.querySelectorAll(`meta[${attrSelector}]`);
-    return list ? [].slice.call(list) : [];
+    return list
+      ? (([].slice.call(list) as HTMLElement[]).filter(
+          (elem) => elem.nodeName.toLowerCase() === 'meta',
+        ) as HTMLMetaElement[])
+      : [];
   }
 
   /**
diff --git a/packages/platform-browser/test/browser/meta_spec.ts b/packages/platform-browser/test/browser/meta_spec.ts
@@ -89,6 +89,24 @@ describe('Meta service', () => {
     expect(actual!.getAttribute('content')).toEqual('4321');
   });
 
+  it('should not allow a custom selector to match off target elements like the body tag', () => {
+    // This payload attempts to break out of the `meta[name="..."]` constraint entirely
+    // and inject a comma to target arbitrary DOM elements like the `body` tag via the
+    // `selector` argument of `updateTag`.
+    const attackerSelector = 'name="description"], body, meta[name="pwned"';
+
+    const firstMeta = metaService.updateTag({content: 'pwned'}, attackerSelector)!;
+
+    expect(firstMeta).not.toBeNull();
+    // It creates a new meta element instead of targeting `body` because it did not
+    // find a meta element matching the dirty selector since `body` is not a `meta` tag
+    expect(firstMeta!.nodeName.toLowerCase()).toEqual('meta');
+    expect(firstMeta!.getAttribute('content')).toEqual('pwned');
+    expect(doc.body.getAttribute('content')).toBeNull();
+
+    metaService.removeTagElement(firstMeta);
+  });
+
   it('should extract selector from the tag definition', () => {
     const selector = 'property="fb:app_id"';
     metaService.updateTag({property: 'fb:app_id', content: '666'});
