fixup! fix(@angular/build): escape prerender redirect URLs

Author: SkyZeroZx

packages/angular/ssr/src/routes/ng-routes.ts

@@ -676,40 +676,6 @@ function invalidRedirectError(routePath: string, reason: string): string {
   return `The 'redirectTo' value for the '${stripLeadingSlash(routePath)}' route is invalid: ${reason}`;
 }
 
-/**
- * Validates and normalizes the `Location` header of a server route configuration.
- *
- * A configured `Location` header turns the route into a redirect, both at runtime and in the static
- * redirect page generated when prerendering, so its value is validated as a redirect target. HTTP
- * header names are case-insensitive, so every entry which names the `Location` header is checked.
- *
- * @param headers - The headers configured for the route.
- * @returns The headers with each `Location` value normalized, or the reason one was rejected.
- */
-function normalizeLocationHeaders(
-  headers: Record<string, string>,
-): { headers: Record<string, string>; error?: undefined } | { headers?: undefined; error: string } {
-  let normalized: Record<string, string> | undefined;
-
-  for (const [name, value] of Object.entries(headers)) {
-    if (name.toLowerCase() !== 'location') {
-      continue;
-    }
-
-    const { url, error } = normalizeAndValidateRedirect(value);
-    if (error !== undefined) {
-      return { error };
-    }
-
-    // Store the normalized value so that the header sent at runtime and the generated static
-    // redirect page are the value which was validated.
-    normalized ??= { ...headers };
-    normalized[name] = url;
-  }
-
-  return { headers: normalized ?? headers };
-}
-
 /**
  * Replaces the route parameters, such as `:id`, in the path of `redirectTo`.
  *
@@ -792,18 +758,6 @@ function buildServerConfigRouteTree({ routes, appShellRoute }: ServerRoutesConfi
       continue;
     }
 
-    if (metadata.headers) {
-      const { headers, error } = normalizeLocationHeaders(metadata.headers);
-      if (error !== undefined) {
-        errors.push(
-          `Invalid '${path}' route configuration: the 'headers.Location' value is invalid: ${error}`,
-        );
-        continue;
-      }
-
-      metadata.headers = headers;
-    }
-
     serverConfigRouteTree.insert(path, metadata);
   }
 

packages/angular/ssr/src/utils/redirect.ts

@@ -238,18 +238,11 @@ export function normalizeAndValidateRedirect(target: string): NormalizedUrl {
 /**
  * Creates an HTTP redirect response with a specified location and status code.
  *
- * This is the only place where a `Location` header is set, so the target is normalized and
- * validated here rather than only where it is configured. A location is not always a configured
- * value which route extraction has already checked: it can be produced by a guard at render time,
- * and it can be composed from the untrusted `X-Forwarded-Prefix` request header. The normalized
- * value is the one sent, so that the emitted header and the value which was checked are the same.
- *
  * @param location - The URL to which the response should redirect.
  * @param status - The HTTP status code for the redirection. Defaults to 302 (Found).
  *                 See: https://developer.mozilla.org/en-US/docs/Web/API/Response/redirect_static#status
  * @param headers - Additional headers to include in the response.
  * @returns A `Response` object representing the HTTP redirect.
- * @throws If `location` is not a supported redirect target.
  */
 export function createRedirectResponse(
   location: string,
@@ -263,16 +256,11 @@ export function createRedirectResponse(
     );
   }
 
-  const { url: normalizedLocation, error } = normalizeAndValidateRedirect(location);
-  if (error !== undefined) {
-    throw new Error(`Cannot redirect to '${location}': ${error}`);
-  }
-
   const resHeaders = headers instanceof Headers ? headers : new Headers(headers);
   if (ngDevMode && resHeaders.has('location')) {
     // eslint-disable-next-line no-console
     console.warn(
-      `Location header "${resHeaders.get('location')}" will be ignored and set to "${normalizedLocation}".`,
+      `Location header "${resHeaders.get('location')}" will be ignored and set to "${location}".`,
     );
   }
 
@@ -288,7 +276,7 @@ export function createRedirectResponse(
   }
 
   resHeaders.set('Vary', [...varySet].join(', '));
-  resHeaders.set('Location', normalizedLocation);
+  resHeaders.set('Location', location);
 
   return new Response(null, {
     status,

packages/angular/ssr/test/routes/ng-routes_spec.ts

@@ -176,108 +176,6 @@ describe('extractRoutesAndCreateRouteTree', () => {
       );
     });
 
-    it("should error when a server route 'headers.Location' uses an unsupported protocol", async () => {
-      setAngularAppTestingManifest(
-        [{ path: 'external', component: DummyComponent }],
-        [
-          {
-            path: 'external',
-            renderMode: RenderMode.Prerender,
-            headers: { Location: 'javascript:alert(1)' },
-          },
-          { path: '**', renderMode: RenderMode.Server },
-        ],
-      );
-
-      const { errors } = await extractRoutesAndCreateRouteTree({ url });
-      expect(errors[0]).toContain(
-        `Invalid 'external' route configuration: the 'headers.Location' value is invalid: ` +
-          `the 'javascript:' protocol is not supported as a redirect target.`,
-      );
-    });
-
-    it("should error when a server route 'headers.Location' contains a backslash", async () => {
-      setAngularAppTestingManifest(
-        [{ path: 'external', component: DummyComponent }],
-        [
-          {
-            path: 'external',
-            renderMode: RenderMode.Prerender,
-            headers: { Location: '/\\evil.example' },
-          },
-          { path: '**', renderMode: RenderMode.Server },
-        ],
-      );
-
-      const { errors } = await extractRoutesAndCreateRouteTree({ url });
-      expect(errors[0]).toContain(
-        `Invalid 'external' route configuration: the 'headers.Location' value is invalid: ` +
-          `'/\\evil.example' is not a valid same-origin path.`,
-      );
-    });
-
-    it("should error when a server route 'headers.Location' resolves into a protocol-relative path", async () => {
-      setAngularAppTestingManifest(
-        [{ path: 'external', component: DummyComponent }],
-        [
-          {
-            path: 'external',
-            renderMode: RenderMode.Server,
-            status: 302,
-            headers: { Location: '/..//evil.example' },
-          },
-          { path: '**', renderMode: RenderMode.Server },
-        ],
-      );
-
-      const { errors } = await extractRoutesAndCreateRouteTree({ url });
-      expect(errors[0]).toContain(
-        `Invalid 'external' route configuration: the 'headers.Location' value is invalid: ` +
-          `'/..//evil.example' is not a valid same-origin path. ` +
-          `It resolves to the protocol-relative path '//evil.example'.`,
-      );
-    });
-
-    it("should error when a server route 'headers.Location' uses an unsupported protocol regardless of the header casing", async () => {
-      setAngularAppTestingManifest(
-        [{ path: 'external', component: DummyComponent }],
-        [
-          {
-            path: 'external',
-            renderMode: RenderMode.Prerender,
-            headers: { LoCaTiOn: 'javascript:alert(1)' },
-          },
-          { path: '**', renderMode: RenderMode.Server },
-        ],
-      );
-
-      const { errors } = await extractRoutesAndCreateRouteTree({ url });
-      expect(errors[0]).toContain(
-        `Invalid 'external' route configuration: the 'headers.Location' value is invalid: ` +
-          `the 'javascript:' protocol is not supported as a redirect target.`,
-      );
-    });
-
-    it("should store the normalized value of a server route 'headers.Location'", async () => {
-      setAngularAppTestingManifest(
-        [{ path: 'external', component: DummyComponent }],
-        [
-          {
-            path: 'external',
-            renderMode: RenderMode.Server,
-            headers: { location: 'HTTPS://Example.com/A b' },
-          },
-          { path: '**', renderMode: RenderMode.Server },
-        ],
-      );
-
-      const { routeTree, errors } = await extractRoutesAndCreateRouteTree({ url });
-      expect(errors).toHaveSize(0);
-      expect(routeTree.match('/external')?.headers).toEqual({
-        location: 'https://example.com/A%20b',
-      });
-    });
-
     it("should error when 'getPrerenderParams' produces a segment which decodes to a separator", async () => {
       setAngularAppTestingManifest(
         [{ path: 'store/:slug', component: DummyComponent }],

packages/angular/ssr/test/utils/redirect_spec.ts

@@ -67,29 +67,6 @@ describe('Redirect Utils', () => {
         /Invalid redirect status code: 200/,
       );
     });
-
-    it('should throw for a location which uses an unsupported protocol', () => {
-      // A `Location` can also be produced at render time, for example by a guard which returns a
-      // `RedirectCommand`, so it cannot rely on the validation performed during route extraction.
-      expect(() => createRedirectResponse('javascript:alert(1)')).toThrowError(
-        /Cannot redirect to 'javascript:alert\(1\)': the 'javascript:' protocol is not supported/,
-      );
-    });
-
-    it('should throw for a location which an untrusted proxy prefix made protocol-relative', () => {
-      // 'X-Forwarded-Prefix' is a request header, so a location built from it is untrusted. The
-      // URL parser reads a leading '/\\' as an authority, which would redirect off-origin.
-      for (const location of ['/\\evil.example/home', '//evil.example/home']) {
-        expect(() => createRedirectResponse(location))
-          .withContext(location)
-          .toThrowError(/is not a valid same-origin path/);
-      }
-    });
-
-    it('should send the normalized location', () => {
-      const response = createRedirectResponse('/docs/../about');
-      expect(response.headers.get('Location')).toBe('/about');
-    });
   });
 
   describe('normalizeAndValidateRoutePath', () => {