Server builder assets can overwrite the generated main.js entry point
维护者通常 1 天内回复
还没有人认领这个 Issue。
评估
- 难度
- 3/5
- 预计耗时
- 1-2 天
- 新手友好度
- 68/100
- Issue 类型
- 缺陷
- 描述清晰度
- 基本清楚
- 活跃度
- 活跃
- 技术栈
- angular, typescript
- 领域
- build-system, security
调研方向
Start with packages/angular_devkit/build_angular/src/builders/server/index.ts, especially the call to copyAssets(), then read packages/angular_devkit/build_angular/src/utils/copy-assets.ts to trace destination writes. Run scripts/validate.sh in the linked reproduction to confirm the collision. Done means the server builder no longer allows an asset to replace generated main.js and the clean and attack scenarios behave as intended.
由索引模型根据 Issue 内容生成。
描述
Command
build, run
Is this a regression?
No. The server builder has copied configured assets after Webpack output since the assets option was released in 15.1.0.
The previous version in which this bug was not present was
No response.
Description
@angular-devkit/build-angular:server copies configured assets after Webpack emits the server program, without checking whether an asset destination is already a generated file.
With a recursive asset tree copied to output ., an asset named main.js silently replaces the generated server entry point. The build reports success, and normal node dist/server/main.js startup executes the asset instead of the generated application bundle.
I reproduced this with an asset-only dependency update. Version 1.0.0 contains only assets/data.json; version 1.0.1 adds only assets/main.js. Neither version declares scripts, main, exports, imports, or bin, installation uses --ignore-scripts, and the application never imports the package.
Expected: the build should reject an asset/generated-output collision, or keep generated output authoritative.
Actual: the build succeeds and the final dist/server/main.js is byte-for-byte identical to the dependency asset. Starting it executes dependency-controlled code as the deployed server process.
Minimal Reproduction
Repository: https://github.com/BlueIridium-Security/angular-server-asset-entry-collision-repro
git clone https://github.com/BlueIridium-Security/angular-server-asset-entry-collision-repro.git
cd angular-server-asset-entry-collision-repro
./scripts/validate.sh
The validator runs clean → attack → restored-clean → restored-attack. Across two fresh-container runs, clean 1.0.0 always emitted and started the same genuine 782,472-byte bundle with no marker; attack 1.0.1 always emitted the exact 192-byte package asset and executed its marker. Runtime networking is disabled, and the script fails on any control mismatch.
Exception or Error
No exception is reported. The builder reports successful bundle generation and asset copying.
Your Environment
Angular CLI: 22.2.0
@angular-devkit/build-angular: 22.2.0
Angular: 22.2.0
Node: 24.21.0
npm: 11.19.0
OS: Linux arm64 container (node:24.21.0-bookworm-slim)
Anything else relevant?
The builder is deprecated but remains shipped. The default server assets list is empty, and exploitation requires an opt-in recursive root-output rule plus an accepted package update, build, deployment, and startup. I therefore assess this as High rather than Critical.
Current source shows the server builder calling copyAssets() after successful Webpack output, while copyAssets() writes each destination without checking generated outputs.
This is distinct from #19157 and #16670, which discuss precedence between two configured asset inputs rather than a post-Webpack asset replacing the executable generated entry point.
Should the server builder reject configured asset destinations that collide with generated output files?
- 主要语言
- TypeScript
- 星标
- 27k
- 派生
- 11.8k
- 平均合并
- 21 小时 31 分钟
- 30 天内合并 PR
- 168
环境准备
- 没有 Dockerfile 或 Docker Compose 文件
- 有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
angular/angular-cli 的其他 Issue
-
area: @angular/build gemini-triaged
难度 2/5 1-3 小时 新手友好度 74/100
angular/angular-cli#33955 ·
维护者通常 1 天内回复
-
area: @angular/cli gemini-triaged
难度 2/5 1-3 小时 新手友好度 72/100
angular/angular-cli#33055 · 1 条评论 · 3 个 reaction ·
维护者通常 1 天内回复
-
难度 4/5 3-5 天 新手友好度 52/100
angular/angular-cli#34207 ·
维护者通常 1 天内回复
-
area: @angular/build gemini-triaged
难度 4/5 3-5 天 新手友好度 48/100
angular/angular-cli#34198 ·
维护者通常 1 天内回复
-
library builder: tslib is not added to the output package.json可能已有人在做 @alan-agius4 于 10 天前认领。 未关闭angular/build:library area: @angular/build gemini-triaged
angular/angular-cli#34131 · 已指派 1 人 ·
维护者通常 1 天内回复
查看 angular/angular-cli 的全部 Issue
相似的 Issue
-
难度 1/5 1 小时以内 新手友好度 78/100
lichess-org/api#678 ·
-
难度 2/5 1-3 小时 新手友好度 84/100
PostHog/posthog.com#20628 ·
维护者通常 1 天内回复
-
bug status:Needs Triage
难度 1/5 1 小时以内 新手友好度 92/100
jupyterlab/jupyterlab#19964 ·
维护者通常 1 天内回复
-
bug
难度 2/5 1-3 小时 新手友好度 78/100
agentscope-ai/QwenPaw#8064 · 1 条评论 ·
维护者通常 1 天内回复
-
area: notebooks-jupyter bug theme: new notebook frontend
难度 2/5 1-3 小时 新手友好度 88/100
posit-dev/positron#16347 · 1 条评论 ·
维护者通常 1 天内回复