fix(@angular/build): escape hostname in host-validation 403 error page

[deprrous]

Problem

The html403() function in host-check-middleware.ts interpolates req.headers.host directly into an HTML response without entity encoding:

const hostname = req.headers.host?.toLowerCase().split(':')[0] ?? '';
res.end(html403(hostname));
// ...
`<h1>Blocked request. This host ("${hostname}") is not allowed.</h1>`

The response is served with Content-Type: text/html. A raw HTTP request with HTML metacharacters in the Host header reflects unescaped content.

Reproduction

ng serve --host 0.0.0.0 --port 4200
curl -s -H 'Host: <img src=x onerror=alert(document.domain)>' http://127.0.0.1:4200/

Response body contains the unescaped payload in a text/html response.

Fix

Add escapeHtml() to encode &, <, >, and " before interpolation into the HTML template.

[gemini-code-assist]

Code Review

This pull request introduces an escapeHtml utility function to sanitize the hostname displayed in the 403 HTML error page of the host check middleware, mitigating potential HTML injection. The reviewer suggested optimizing this function by using a single regular expression with a character map lookup instead of chained .replace calls, and extending it to escape single quotes (') to ensure robust XSS prevention.

[gemini-code-assist]

The current implementation of escapeHtml uses multiple chained .replace calls with regular expressions, which results in multiple string allocations and full-string scans. Additionally, it does not escape the single quote ('), which is a standard HTML entity that should be escaped to prevent potential XSS vulnerabilities in attribute contexts.

Using a single regular expression with a character class and a map lookup is more efficient and allows us to easily include the single quote (') in the escaped characters.

function escapeHtml(value: string): string {
  const entityMap: Record<string, string> = {
    '&': '&amp;',
    '<': '&lt;',
    '>': '&gt;',
    '"': '&quot;',
    "'": '&#39;',
  };
  return value.replace(/[&<>"']/g, (s) => entityMap[s]);
}

[alan-agius4]

Thank you for reporting this and submitting a PR.

We are closing this as it is not an exploitable security vulnerability. For a reflected XSS attack to be exploitable against a victim, an attacker must be able to trick a victim's browser into sending the malicious payload to the server.

Since ng serve is a local development server and an attacker cannot induce a victim's browser to send a crafted Host header containing HTML metacharacters, this scenario does not present an exploitable security risk.