fix(@angular/build): escape prerender redirect URLs - #33248

Validation shouldn't happen here, it should happen why before during the extraction phase.

It assumes the attacker can already modify the source code on your machine or alter the database if the routes are built dynamically. If an attacker already has that level of access, they could inflict far worse damage anyway.

In this regard, it is possible that we might use a third-party API that could be compromised; if that happens, the impact, instead of affecting only one company/person, would extend far beyond that.

Also we can happend when using getPrerenderParams

export const serverRoutes: ServerRoute[] = [
  {
    path: 'store/:tenant/legacy/:slug',
    renderMode: RenderMode.Prerender,
    fallback: PrerenderFallback.None,
    async getPrerenderParams() {
     // Got data from some backend endpoint
      return  [someAttack, pathAttack]
    },
  },
  {
    path: '**',
    renderMode: RenderMode.Prerender,
  },
];

We can also inject a function that can call a third-party HTTP endpoint, such as a CMS or some external source, which can be compromised (this does not require the attacker to have access to the source code; as mentioned, it can be a compromised service that impacts other users).

export const routes: Routes = [
  {
    path: 'old',
    pathMatch: 'full',
    // Compromised HTTP request
    redirectTo: () => inject(CmsRedirectService).getLegacyRedirectTarget(), 
  },
  {
    path: 'new',
    loadComponent: () => import('./app').then((m) => m.App),
  },
];

@alan-agius4 I've rebased and updated the PR; could you review it? I believe this is a security vulnerability so I can backport for this week's patch.

JSON.stringify() protects the generated JavaScript syntax, but dynamic import specifiers are also parsed as URLs.
Decoded prerender parameters may contain URL-significant characters such as #, ?, or %; if left unencoded, Node can interpret them as fragments, query strings, or escape sequences and resolve a different chunk path.
Encoding each path segment preserves directory separators while keeping those characters as filename data. JSON.stringify() then safely embeds the resulting specifier in the executable manifest. The physical chunk filename remains unchanged.

This would also prevent, as a defense in depth, the initially closed vector of both RCE and XSS that was present along the routes.

[Gemini Review]: Validating individual parameter segments in isolation here causes a few issues:

1. DX Breaking change: Validating raw segments rejects legitimate slugs with apostrophes (customer's-choice, women's-fashion) and spaces. Downstream in route-tree.ts (getPathSegments), .map(decodeURIComponent) is called, which immediately decodes %27 back to ' anyway. Single quotes in asset keys are already safely escaped by JSON.stringify(key) in manifest.ts.
2. Segments lack route context: An isolated segment like '42' is not a URL. Furthermore, this misses compositional issues (e.g. if a segment combined with the route forms a protocol-relative // or traversal ../).

Instead of validating each segment here, let's remove this check and validate the generated route path (routeWithResolvedParams) in handleSSGRoute (around line 474):

const routeWithResolvedParams = currentRoutePath
  .replace(URL_PARAMETER_GLOBAL_REGEXP, replacer)
  .replace(CATCH_ALL_REGEXP, replacer);

// Validate and normalize the generated path
const slashPath = addLeadingSlash(routeWithResolvedParams);
if (slashPath.startsWith('//') || slashPath.includes('\\')) {
  yield {
    error: `The '${stripLeadingSlash(currentRoutePath)}' route produced an invalid prerender path '${routeWithResolvedParams}'.`,
  };
  continue;
}

try {
  const parsed = new URL(slashPath, 'http://127.0.0.1');
  if (parsed.origin !== 'http://127.0.0.1') {
    yield {
      error: `The '${stripLeadingSlash(currentRoutePath)}' route produced an escaping prerender path '${routeWithResolvedParams}'.`,
    };
    continue;
  }
  const normalizedRoute = parsed.pathname;
  // yield normalizedRoute...
} catch (err) {
  yield { error: `Invalid prerender path '${routeWithResolvedParams}': ${(err as Error).message}` };
}

This automatically normalizes spaces (/docs/a b -> /docs/a%20b) and percent-encodes HTML characters (<script> -> %3Cscript%3E), while leaving apostrophes intact without failing the build.

All the indicated changes have been addressed; another commit was made to tackle the potential RCE issue.

EDIT: It seems there is a conflict; I am currently rebasing to resolve it.

EDIT2: Done

Upon closer inspection (with the help of an agent), this could fail if used on Windows, so I added this helper to avoid these issues.