CodeVetter · Repo Unpack · Risk map
angular/angular
The following items are security-sensitive boundaries and maintenance observations, not confirmed vulnerabilities. HTML insertion, HTTP credentials, extension messaging, host build commands, and workflow trust transitions warrant focused review when changed. Source also exposes explicit compatibility constraints and limited validation at persistence boundaries. Any predicted failure is labeled as an inference, and partial inspection does not establish missing protections elsewhere.
- DomSanitizerImpl sanitizes HTML and URLs, rejects untrusted script/resource URLs, and exposes bypassSecurityTrust methods that deliberately disable those protections for supplied values.
- DocViewer assigns supplied content directly to nativeElement.innerHTML; this makes the generated document-content pipeline a trust boundary rather than an automatically sanitized Angular template binding.
- SamePageMessageBus emits window messages with targetOrigin '*', checks the receiving window and source marker, and updates bus status before those checks in on/onAny; the bridge also exposes updateState operations.
- FetchBackend buffers complete response chunks before parsing. Its default 1 MiB limit applies in SSR mode, while browser mode defaults to no limit; the implementation checks both declared content length and accumulated bytes.
- withCredentials overrides an explicit credentials setting to 'include'; XSRF skips GET/HEAD, disabled protection, invalid URLs, and cross-origin requests, so callers must understand these separate transport and token rules.
- Hypothesis: valid JSON of an unexpected shape in docs-search-history-v1 can break restoration because JSON.parse is caught but the subsequent iteration and item access have no shape validation in loadHistory. (inferred)
- package-builder uses execSync with command strings, accepts the BAZEL environment override, removes output directories, and interpolates paths without shell quoting; it is a host-side execution and filesystem boundary, not a read-only inspection helper.
- Tutorial sandbox code starts npm and bash processes and recursively removes files during cleanup, but these operations are issued through WebContainer rather than host child_process.
- Preview automation intentionally separates unprivileged PR building from credentialed deployment; benchmark comparison instead checks team membership before checking out and executing the PR head, making that approval boundary consequential.
- ComponentDecoratorHandler disables deferred dependencies during HMR because update modules cannot have dynamic imports; changing dependency deferral without preserving this coupling can alter generated HMR references.
- parseTemplate explicitly documents an existing ICU whitespace-context bug and preserves the current runtime representation; this is a source-acknowledged compatibility constraint, not a newly reproduced defect.
- The compiler architecture document is labeled Draft and discusses experimental Ivy and ngcc; its historical proposals should not be treated as proof of this commit's current runtime or distribution behavior.