Skip to content

fix: reject port in host header to prevent SSR SSRF bypass #32981

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
chupaohong wants to merge 1 commit into from
+6 −1
Closed

fix: reject port in host header to prevent SSR SSRF bypass #32981

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 6 additions & 1 deletion packages/angular/ssr/src/utils/validation.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -224,7 +224,12 @@ function verifyHostAllowed(
throw new Error(`Header "${headerName}" contains an invalid value and cannot be parsed.`);
}

const { hostname } = new URL(url);
const { hostname, port } = new URL(url);
if (port) {
throw new Error(
`Header "${headerName}" with value "${value}" contains a port and is not allowed.`,
);
}
Comment on lines +227 to +232
Copy link
Copy Markdown

@gemini-code-assist gemini-code-assist bot Apr 10, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

security-high high

The current check using new URL().port is insufficient because the port property of a URL object returns an empty string if the port matches the default for the scheme (e.g., port 80 for the hardcoded http:// prefix). This means a host header like localhost:80 would bypass this validation, potentially allowing an SSRF attack if an internal service is running on port 80.

Since VALID_HOST_REGEX already restricts the host format and currently does not support IPv6, checking for the presence of a colon in the value is a more robust way to detect any port specification.

Additionally, please add unit tests in packages/angular/ssr/test/utils/validation_spec.ts to verify that both standard (80) and non-standard ports are correctly rejected, ensuring the fix for CVE-2026-27739 is complete. While out of scope for this specific hunk, consider updating VALID_HOST_REGEX to also disallow ports, which would provide an earlier rejection in validateHeaders.

Suggested change
const { hostname, port } = new URL(url);
if (port) {
throw new Error(
`Header "${headerName}" with value "${value}" contains a port and is not allowed.`,
);
}
const { hostname, port } = new URL(url);
if (port || value.includes(':')) {
throw new Error(
"Header \"" + headerName + "\" with value \"" + value + "\" contains a port and is not allowed.",
);
}

if (!isHostAllowed(hostname, allowedHosts)) {
throw new Error(`Header "${headerName}" with value "${value}" is not allowed.`);
}
Expand Down
Loading