Visitar URL original
fix(common): harden param encoding against prototype pollution · angular/angular@fafec77 · GitHub
Skip to content

Commit fafec77

Browse files
committed
fix(common): harden param encoding against prototype pollution
The parameter encoding was using a plain object literal lookup to determine how to encode specific characters. This makes it vulnerable to prototype pollution. These changes mitigate the issue by storing the mapping in a native `Map` instead. (cherry picked from commit 01c883e)
1 parent 68c6c57 commit fafec77

1 file changed

Lines changed: 2 additions & 18 deletions

File tree

‎packages/common/http/src/params.ts‎

Lines changed: 2 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -96,26 +96,10 @@ function paramParser(rawParams: string, codec: HttpParameterCodec): Map<string,
9696
return map;
9797
}
9898

99-
/**
100-
* Encode input string with standard encodeURIComponent and then un-encode specific characters.
101-
*/
102-
const STANDARD_ENCODING_REGEX = /%(\d[a-f0-9])/gi;
103-
const STANDARD_ENCODING_REPLACEMENTS: {[x: string]: string} = {
104-
'40': '@',
105-
'3A': ':',
106-
'24': '$',
107-
'2C': ',',
108-
'3B': ';',
109-
'3D': '=',
110-
'3F': '?',
111-
'2F': '/',
112-
};
99+
const STANDARD_ENCODING_REGEX = /[&+#]/g;
113100

114101
function standardEncoding(v: string): string {
115-
return encodeURIComponent(v).replace(
116-
STANDARD_ENCODING_REGEX,
117-
(s, t) => STANDARD_ENCODING_REPLACEMENTS[t] ?? s,
118-
);
102+
return encodeURI(v).replace(STANDARD_ENCODING_REGEX, encodeURIComponent);
119103
}
120104

121105
function valueToString(value: string | number | boolean): string {

0 commit comments

Comments
 (0)