[SkyZeroZx]

Remote font CSS is embedded into a raw-text style element. Escape closing style tags so a compromised allowlisted response cannot terminate the style element and inject nonce-bearing markup.

For example, an attacker controlling the CSS response from an allowlisted font provider ,through provider, cache, or trusted HTTPS proxy compromise , could include </style><script>evil</script>.

During a production build, Angular embedded this response inside a <style> element, turning external CSS into executable first-party JavaScript. If the application used ngCspNonce, later processing also copied the trusted nonce onto the injected script, allowing it to execute under a nonce based CSP. This commit neutralizes closing </style> sequences before embedding the CSS into generated HTML.

[gemini-code-assist]

Code Review

This pull request addresses a potential security vulnerability by escaping closing style tags (e.g., </style>) within inlined CSS content to prevent them from prematurely terminating the generated raw-text style element. It also adds a corresponding unit test to verify that closing style tags are correctly escaped and do not lead to arbitrary HTML injection. I have no feedback to provide as there are no review comments.

[alan-agius4]

Thanks for the contribution.

In practice, font stylesheets are fetched strictly over HTTPS from a hardcoded allowlist of trusted origins (fonts.googleapis.com and Adobe Typekit). Because TLS provides end-to-end transport integrity even when operating through standard forward proxies network tampering or injection is not possible. If an environment's TLS root of trust or origin were compromised, an attacker would already have full control over the build environment (e.g. via npm dependencies).

[angular-automatic-lock-bot]

This pull request has been automatically locked due to inactivity.
Please file a new issue if you are encountering a similar or related problem.

Read more about our automatic conversation locking policy.

_{This action has been performed automatically by a bot.}