From 602fe2229b5ba887ab4acbaea841ed38774c7c04 Mon Sep 17 00:00:00 2001 From: deprrous Date: Wed, 29 Jul 2026 18:59:32 +0800 Subject: [PATCH] fix(@angular/build): escape hostname in host-validation 403 error page The Host header value was interpolated directly into the HTML response without entity encoding. While browsers set Host automatically (preventing direct exploitation), a raw HTTP request with HTML metacharacters in the Host header would reflect unescaped content in a text/html response. Add escapeHtml() to encode &, <, >, and " before interpolation. --- .../vite/middlewares/host-check-middleware.ts | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/packages/angular/build/src/tools/vite/middlewares/host-check-middleware.ts b/packages/angular/build/src/tools/vite/middlewares/host-check-middleware.ts index 8561354812b3..bf7d2935142d 100644 --- a/packages/angular/build/src/tools/vite/middlewares/host-check-middleware.ts +++ b/packages/angular/build/src/tools/vite/middlewares/host-check-middleware.ts @@ -42,7 +42,17 @@ export function patchHostValidationMiddleware(middlewares: Connect.Server): void }; } +function escapeHtml(value: string): string { + return value + .replace(/&/g, '&') + .replace(//g, '>') + .replace(/"/g, '"'); +} + function html403(hostname: string): string { + const safeHostname = escapeHtml(hostname); + return ` @@ -61,12 +71,12 @@ function html403(hostname: string): string {
-

Blocked request. This host ("${hostname}") is not allowed.

+

Blocked request. This host ("${safeHostname}") is not allowed.

To allow this host, add it to allowedHosts under the serve target in angular.json.

{
   "serve": {
     "options": {
-      "allowedHosts": ["${hostname}"]
+      "allowedHosts": ["${safeHostname}"]
     }
   }
 }