PD-6118 semgrep angular vulnerabilities - #2906
Open
cryptalith wants to merge 4 commits into
Open
Conversation
Semgrep reported 440 High/Reachable/Direct supply-chain findings against orcid-angular. They are one row per usage site and collapse to three CVEs, all in Angular 20.1.6: CVE-2025-66035 @angular/common XSRF token leak (fixed 20.3.14) CVE-2026-22610 @angular/compiler SVG script href XSS (fixed 20.3.16) CVE-2026-54267 @angular/core hydration clobbering(fixed 20.3.25) Move the framework to 20.3.27, CDK and Material to 20.2.14, and the CLI toolchain to 20.3.33. Staying on v20 means no migration. This also picks up the i18n XSS advisories, which are not in the Semgrep export but matter more here than the SVG one, since the app ships ten locales and has no attr.href bindings anywhere. Audit count drops from 79 to 44 with no runtime package left affected; the rest is build tooling. Also drop provideClientHydration() from orcid-ui-elements. No project in angular.json builds with SSR or prerendering, so it restores nothing and only arms the ng-state lookup CVE-2026-54267 abuses — a bad trade in a bundle that embeds into third-party pages.
CVE-2025-66035 describes HttpClient treating protocol-relative URLs as same-origin and attaching the XSRF header. Our fallback interceptor had the same defect independently, so upgrading Angular does not fix it: const isRelativeRequest = req.url.startsWith('/') '//evil.com/steal' satisfies that test, so the request was classified as backend, matched no auth host, fell through to XSRF-TOKEN and was sent with the token attached and withCredentials set. toAbsoluteUrl() already resolved '//' correctly for the host comparisons, which is what made this easy to miss — the host checks were right and the relative check short-circuited past them. This is live traffic rather than a corner case: API_WEB and BASE_URL are themselves protocol-relative, so '//host/path' is the normal shape of a backend call here. Exclude the '//' prefix from the relative test only; host comparison still accepts a protocol-relative URL that genuinely points at the API. Both directions are covered by tests — a foreign host gets nothing, the API host still gets its token.
src/test.ts was configured as the karma main but contained only the zone.js import and initTestEnvironment — the require.context that pulls in spec files was missing. With a main set, the builder loads only that entry, so ng test ran 1 test while 334 spec files sat unexecuted. The suite has effectively been a no-op in CI, which is why a live XSRF flaw survived in a file that ships with tests. Declare zone.js/testing alongside the existing polyfills and drop main, which lets the builder discover specs from tsconfig.spec.json. Delete test.ts, now unreachable, and drop it from the spec tsconfig files list.
Turning spec discovery back on surfaced six component specs that had never run. They fail identically on 20.1.6, so none of this is fallout from the upgrade — they simply rotted unobserved. Most were missing TestBed imports for what their templates actually use: MatFormField/MatInput for mat-form-field and the errorStateMatcher binding, MatCard/MatCheckbox for the interstitial, ReactiveFormsModule for [formGroup], and CUSTOM_ELEMENTS_SCHEMA where a template renders a sibling app-* component. Real modules rather than NO_ERRORS_SCHEMA, so the specs keep catching template errors. Two specs stubbed FormBuilder with object literals that only looked like form controls. They passed only because ReactiveFormsModule was absent and the bindings were never evaluated; with the directives present they have to be real, so use the actual FormBuilder. ShareEmailsDomains also needed a record carrying emailDomains, since the component builds its form inside a filtered subscription and an empty record left formGroup bound to undefined. Full suite: 686 passing, 0 failures.
Member
cryptalith
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.