fix(compiler): support inert script tags in templates

[vicb]

fixes #9695

/cc @mprobst @rjamet for security

The former behavior was to remove all script tags from the template. After this PR, only script tags containing javascript are removed, other inert tags are left untouched. One of the use case is JSON-LD as described in the original issue

[rjamet]

Sounds good in principle, but I'm a little wary of the blacklist of Javascript types: I can't find a source for what is and isn't specified or supported. For instance, you missed text/vbscript, and that would probably be able to XSS IE9. Same thing if script types are added (native Dart or whatever). Would a whitelist of non-script-running types be possible instead?

Also, if a browser ever runs scripts with unknown types, this becomes dangerous. They shouldn't, I think all reasonable ones don't, but I haven't found a good source confirming this :/

[mprobst]

On a general note, the fact that Angular ignores <script> tags is not really a security boundary, more a method of protecting the developer from themselves (footgun prevention).

If an attacker can smuggle code into a template, then they can execute arbitrary JavaScript expressions in the page context, so all is lost anyway.

@rjamet, do you think it's worth maintaining this (ignoring JavaScript), or should we just accept it?

[mprobst]

This seems a bit dangerous – I wouldn't be surprised if you could find a MIME type here that doesn't match your regexp, but will lead browsers to execute the <script> content.

What about inverting the check, and whitelisting MIME types we know to be safe? E.g. template, JSON LD, etc?

[mprobst]

@rjamet Hadn't seen your comment for some reason, agreed on the whitelisting :-)

[rjamet]

@mprobst I think it's both footgun prevention and good practices enforcement, and I can definitely imagine people embedding snippets of JS to bypass the compiler or a good practices checker in their templates :/

[angular-automatic-lock-bot]

This issue has been automatically locked due to inactivity.
Please file a new issue if you are encountering a similar or related problem.

Read more about our automatic conversation locking policy.

_{This action has been performed automatically by a bot.}