Skip to content

[Backport 20.3.X] fix(@angular/build): escape prerender redirect URLs - #34509

Merged
alan-agius4 merged 1 commit into
angular:20.3.xfrom
SkyZeroZx:fix/escape-prerender-redirect-urls-20.3.x
Oct 26, 2026
Merged

alan-agius4 merged 1 commit into
angular:20.3.xfrom
SkyZeroZx:fix/escape-prerender-redirect-urls-20.3.x

Conversation

@SkyZeroZx

Copy link
Copy Markdown
Contributor

Backport #33248

@gemini-code-assist gemini-code-assist Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request introduces HTML escaping for URLs interpolated into static redirect pages during server-side rendering, preventing potential XSS vulnerabilities and ensuring correct HTML formatting. Unit and end-to-end tests have been added to verify the escaping behavior. I have no feedback to provide as there are no review comments to assess.

@alan-agius4 alan-agius4 added the action: merge The PR is ready for merge by the caretaker label Oct 26, 2026
@alan-agius4 alan-agius4 added the target: lts This PR is targeting a version currently in long-term support label Oct 26, 2026
Escape redirect targets before embedding them in the meta refresh tag and the fallback link of
generated static redirect pages.
@alan-agius4
alan-agius4 force-pushed the fix/escape-prerender-redirect-urls-20.3.x branch from 41e952d to 5d23843 Compare October 26, 2026 10:29
@alan-agius4
alan-agius4 merged commit 223891d into angular:20.3.x Oct 26, 2026
30 of 31 checks passed
@alan-agius4

Copy link
Copy Markdown
Collaborator

This PR was merged into the repository. The changes were merged into the following branches:

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

action: merge The PR is ready for merge by the caretaker area: @angular/build target: lts This PR is targeting a version currently in long-term support

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants