Which @angular/* package(s) are the source of the bug?
platform-browser
Is this a regression?
No
Description
MetaDefinition allows arbitrary keys, and the Meta service writes those keys directly as attributes on the resulting <meta> element.
Because of that, addTag(), addTags() and updateTag() also allow on* event-handler attributes, even though Angular normally rejects them in template bindings.
For example, addTags() can produce automatic script execution using two metadata entries:
meta.addTags([
{
httpEquiv: 'Content-Security-Policy',
content: "style-src 'none'",
},
{
onsecuritypolicyviolation: 'alert(document.cookie)',
style: 'color:red',
},
]);The first meta activates the CSP. When Angular inserts the second one, its inline style is blocked and Chromium fires securitypolicyviolation on that same element, executing the handler.
updateTag() can also trigger execution automatically when updating an existing meta element:
<meta property="product:price:amount" content="10">
meta.updateTag({
property: 'product:price:amount',
content: '10',
oncontentvisibilityautostatechange: 'alert(document.cookie)',
style: 'display:block;content-visibility:auto;position:absolute',
});Once the element is updated, Chromium fires contentvisibilityautostatechange and the event handler runs without user interaction.
Anything else?
#68836 prevents escaping the generated meta selector, but it does not validate the attributes written to the selected or created meta element.
This also seems similar in principle to GHSA-jj27-h5hq-8x99, where another Angular path allowed event-handler attributes that normal Angular validation rejects.
As an additional note, based on a quick GitHub search, allowing custom metadata or loading relatively arbitrary JSON that is later passed to Meta for SEO seems fairly common, especially for social previews, cards and similar metadata.
This also makes sense (or at least for me ) for things like social previews, cards and other SEO metadata, where applications often need to support custom fields rather than a fixed set of values.
Which @angular/* package(s) are the source of the bug?
platform-browser
Is this a regression?
No
Description
MetaDefinitionallows arbitrary keys, and theMetaservice writes those keys directly as attributes on the resulting<meta>element.Because of that,
addTag(),addTags()andupdateTag()also allowon*event-handler attributes, even though Angular normally rejects them in template bindings.For example,
addTags()can produce automatic script execution using two metadata entries:The first meta activates the CSP. When Angular inserts the second one, its inline style is blocked and Chromium fires
securitypolicyviolationon that same element, executing the handler.updateTag()can also trigger execution automatically when updating an existing meta element:Once the element is updated, Chromium fires
contentvisibilityautostatechangeand the event handler runs without user interaction.Anything else?
#68836 prevents escaping the generated meta selector, but it does not validate the attributes written to the selected or created meta element.
This also seems similar in principle to GHSA-jj27-h5hq-8x99, where another Angular path allowed event-handler attributes that normal Angular validation rejects.
As an additional note, based on a quick GitHub search, allowing custom metadata or loading relatively arbitrary JSON that is later passed to
Metafor SEO seems fairly common, especially for social previews, cards and similar metadata.This also makes sense (or at least for me ) for things like social previews, cards and other SEO metadata, where applications often need to support custom fields rather than a fixed set of values.