From 3264222dd9c3c11f9039f4c1488729e1032bdf59 Mon Sep 17 00:00:00 2001 From: istesf Date: Thu, 16 Jul 2026 00:56:10 +0700 Subject: [PATCH] fix(zone.js): prevent prototype pollution of UNPATCHED_EVENTS and patchEventTarget Add hasOwnProperty checks before reading internal flags from the Zone object to prevent prototype pollution attacks. --- packages/zone.js/lib/browser/event-target.ts | 3 ++- packages/zone.js/lib/common/events.ts | 6 +++++- 2 files changed, 7 insertions(+), 2 deletions(-) diff --git a/packages/zone.js/lib/browser/event-target.ts b/packages/zone.js/lib/browser/event-target.ts index 412eb4964d4d..3439d1388592 100644 --- a/packages/zone.js/lib/browser/event-target.ts +++ b/packages/zone.js/lib/browser/event-target.ts @@ -7,7 +7,8 @@ */ export function eventTargetPatch(_global: any, api: _ZonePrivate) { - if ((Zone as any)[api.symbol('patchEventTarget')]) { + const patchSym = api.symbol('patchEventTarget'); + if ((Zone as any).hasOwnProperty(patchSym) && (Zone as any)[patchSym]) { // EventTarget is already patched. return; } diff --git a/packages/zone.js/lib/common/events.ts b/packages/zone.js/lib/common/events.ts index 73a67cfd2c8c..f64642677601 100644 --- a/packages/zone.js/lib/common/events.ts +++ b/packages/zone.js/lib/common/events.ts @@ -488,7 +488,11 @@ export function patchEventTarget( const compare = patchOptions?.diff || compareTaskCallbackVsDelegate; - const unpatchedEvents: string[] = (Zone as any)[zoneSymbol('UNPATCHED_EVENTS')]; + const unpatchedSymbol = zoneSymbol('UNPATCHED_EVENTS'); + const unpatchedEvents: string[] = (Zone as any).hasOwnProperty(unpatchedSymbol) + ? (Zone as any)[unpatchedSymbol] + : []; + const passiveEvents: string[] = _global[zoneSymbol('PASSIVE_EVENTS')]; function copyEventListenerOptions(options: any) {