fix(platform-browser): don't write styles to a clobbered style property - #71255

PR Checklist

Please check if your PR fulfills the following requirements:

• The commit message follows our guidelines: https://github.com/angular/angular/blob/main/contributing-docs/commit-message-guidelines.md
• Tests for the changes have been added (for bug fixes / features)
• Docs have been added / updated (for bug fixes / features)

PR Type

What kind of change does this PR introduce?

• Bugfix
• Feature
• Code style update (formatting, local variables)
• Refactoring (no functional changes, no api changes)
• Build related changes
• CI related changes
• Documentation content changes
• angular.dev application / infrastructure changes
• Other... Please describe:

What is the current behavior?

Issue Number: #70021

HTMLFormElement is [LegacyOverrideBuiltIns], so a form-associated control named style is exposed as an own property of the <form> and shadows the inherited style accessor. setStyle() and removeStyle() read el.style and then write the style name onto it, so on such a form the write lands on the control rather than on a CSSStyleDeclaration.

All styling goes through those two methods, and with [ngStyle], [style] or [style.<prop>] the style name comes from the bound value, which makes innerHTML and outerHTML HTML sinks:

<form [ngStyle]="styles"><button name="style" type="button">Save</button></form>

styles = {innerHTML: '<img src="x" onerror="alert(document.domain)">'};

In Chrome 154 form.style is the <button>, the markup is written into it and the <img> is live in the document. removeStyle() follows the same path and clears the control's innerHTML instead.

What is the new behavior?

Both methods return early when el.style is not a style declaration. The form was never styled on this path to begin with, so nothing that works today changes, and elements that do have a declaration are untouched.

Does this PR introduce a breaking change?

• Yes
• No

Other information

The two tests fail on main in test_web_chromium and test_web_firefox (Expected '<img src="#">' to be '' and Expected '' to be 'Save') and pass with the change. The node target skips this suite, and domino does not implement the form named getter, so the clobbering is browser-only.