fix(@angular/ssr): use only the first value of the X-Forwarded-Prefix header

The `X-Forwarded-Prefix` header is validated using its first
comma-separated value, like the other `X-Forwarded-*` headers. However,
redirects used the entire header value. With a trusted header, any
value after the first one was added to the `Location` header without
being validated.

The first value is now used wherever the header is read, which matches
how `X-Forwarded-Host`, `X-Forwarded-Proto` and `X-Forwarded-Port` are
handled.

Author: SkyZeroZx

packages/angular/ssr/src/app-engine.ts

@@ -13,6 +13,7 @@ import { EntryPointExports, getAngularAppEngineManifest } from './manifest';
 import { createRedirectResponse } from './utils/redirect';
 import { joinUrlParts } from './utils/url';
 import {
+  getFirstHeaderValue,
   normalizeTrustProxyHeaders,
   sanitizeRequestHeaders,
   validateRequest,
@@ -208,7 +209,7 @@ export class AngularAppEngine {
     if (preferredLocale) {
       const subPath = supportedLocales[preferredLocale];
       if (subPath !== undefined) {
-        const prefix = request.headers.get('X-Forwarded-Prefix') ?? '';
+        const prefix = getFirstHeaderValue(request.headers.get('X-Forwarded-Prefix')) ?? '';
 
         return createRedirectResponse(
           joinUrlParts(prefix, pathname, subPath),

packages/angular/ssr/src/app.ts

@@ -25,6 +25,7 @@ import { AngularBootstrap, renderAngular } from './utils/ng';
 import { promiseWithAbort } from './utils/promise';
 import { createRedirectResponse } from './utils/redirect';
 import { buildPathWithParams, joinUrlParts, stripLeadingSlash } from './utils/url';
+import { getFirstHeaderValue } from './utils/validation';
 
 /**
  * A set of well-known URLs that are not handled by Angular.
@@ -167,7 +168,7 @@ export class AngularServerApp {
 
     if (redirectTo !== undefined) {
       const location = joinUrlParts(
-        request.headers.get('X-Forwarded-Prefix') ?? '',
+        getFirstHeaderValue(request.headers.get('X-Forwarded-Prefix')) ?? '',
         buildPathWithParams(redirectTo, url.pathname),
       );
 

packages/angular/ssr/src/utils/ng.ts

@@ -25,6 +25,7 @@ import {
 import { ActivatedRoute, Router } from '@angular/router';
 import { Console } from '../console';
 import { addTrailingSlash, joinUrlParts, stripIndexHtmlFromURL, stripTrailingSlash } from './url';
+import { getFirstHeaderValue } from './validation';
 
 /**
  * Represents the bootstrap mechanism for an Angular application.
@@ -126,7 +127,9 @@ export async function renderAngular(
 
       const requestPrefix =
         envInjector.get(APP_BASE_HREF, null, { optional: true }) ??
-        envInjector.get(REQUEST, null, { optional: true })?.headers.get('X-Forwarded-Prefix');
+        getFirstHeaderValue(
+          envInjector.get(REQUEST, null, { optional: true })?.headers.get('X-Forwarded-Prefix'),
+        );
 
       const { pathname, search, hash } = envInjector.get(PlatformLocation);
       const finalUrl = constructSerializedUrl(router, { pathname, search, hash }, requestPrefix);

packages/angular/ssr/test/app-engine_spec.ts

@@ -202,6 +202,19 @@ describe('AngularAppEngine', () => {
         expect(response?.headers.get('Vary')).toBe('X-Forwarded-Prefix, Accept-Language');
       });
 
+      it('should only use the first value of the forwarded prefix in locale redirect location', async () => {
+        const request = new Request('https://example.com', {
+          headers: {
+            'Accept-Language': 'it',
+            'X-Forwarded-Prefix': '/app, /"<other>',
+          },
+        });
+
+        const response = await appEngine.handle(request);
+        expect(response?.status).toBe(302);
+        expect(response?.headers.get('Location')).toBe('/app/it');
+      });
+
       it('should completely ignore proxy headers if not allowed', async () => {
         const strictEngine = new AngularAppEngine({ trustProxyHeaders: false });
         const request = new Request('https://example.com', {

packages/angular/ssr/test/app_spec.ts

@@ -538,6 +538,16 @@ describe('AngularServerApp', () => {
           expect(response?.headers.get('location')).toBe('/base/home?filter=test');
           expect(response?.status).toBe(302);
         });
+
+        it('should only use the first value of the "X-Forwarded-Prefix" header in redirects', async () => {
+          const response = await app.handle(
+            new Request('http://localhost/redirect', {
+              headers: { 'X-Forwarded-Prefix': '/base, /"<other>' },
+            }),
+          );
+          expect(response?.headers.get('location')).toBe('/base/home');
+          expect(response?.status).toBe(302);
+        });
       });
 
       describe('Critical CSS inlining', () => {