fix(deploy): prevent code-generation injection from angular.json values - #3739
Open
herdiyana256 wants to merge 1 commit into
Open
fix(deploy): prevent code-generation injection from angular.json values#3739herdiyana256 wants to merge 1 commit into
herdiyana256 wants to merge 1 commit into
Conversation
deployToFunction / deployToCloudRun interpolate several angular.json-derived
values straight into generated, later-executed artifacts. A server build
target's outputPath is written raw into the generated Cloud Function index.js
(`require('./<outputPath>/main')`) and into the generated package.json start
script (`node <outputPath>/main.js`), and functionsNodeVersion is written raw
into the generated Cloud Run Dockerfile (`FROM node:<version>-slim`). A
malicious or cloned workspace could therefore run arbitrary code in the
deployed function/container (and locally during `firebase serve` preview) via
`ng deploy`. These sinks are distinct from the gcloud argv path (PR angular#3726) and
the execSync sinks (PR angular#3738).
Validate each build target's outputPath (assertSafeOutputPath) and
functionsNodeVersion (assertSafeNodeVersion) before they reach code
generation, reject values carrying quotes/newlines/shell metacharacters, and
add a functionsNodeVersion schema pattern. Adds unit tests for both validators.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The SSR deploy builders interpolate several
angular.json-derived values straight into generated artifacts that are later executed.A server build target's
outputPath(read viagetTargetOptions) is written raw into the generated Cloud Functionindex.jsasrequire('./${path}/main')and into the generatedpackage.jsonstart script asnode ${path}/main.js.functionsNodeVersionis written raw into the generated Cloud RunDockerfileasFROM node:${version}-slim. None of these has any validation. A crafted serveroutputPathsuch asx').app(); require('child_process').execSync('...'); ('lands as a standalone statement inindex.jsand runs on every Cloud Function cold start (and locally duringfirebase servepreview); a craftedfunctionsNodeVersioninjects extraRUNinstructions executed during the Cloud Run container build. Reachable the moment a developer runsng deployon a malicious or cloned workspace. These are distinct sinks from the gcloud argv path and theexecSynccalls addressed separately.The fix validates each build target's
outputPath(assertSafeOutputPath) andfunctionsNodeVersion(assertSafeNodeVersion) before they reach code generation, rejecting values that carry quotes, newlines, or shell metacharacters, and adds afunctionsNodeVersionschemapattern. Unit tests cover both validators.npm run test:nodepasses (150 specs, 0 failures); lint and typecheck clean.