fix(compiler): disallow i18n event attributes

Hexix23 · atscott · commit 1ee224ca30b9 · 2026-06-10T17:21:38.000Z
Reject translated event-handler attributes so localization cannot bypass Angular event-attribute validation. (cherry picked from commit 6c41f5c)
diff --git a/packages/compiler/src/render3/view/i18n/meta.ts b/packages/compiler/src/render3/view/i18n/meta.ts
@@ -208,7 +208,7 @@ export class I18nMetaVisitor implements html.Visitor {
             isTrustedType = isTrustedTypesSink(node.name, name);
           }
 
-          if (isTrustedType) {
+          if (isTrustedType || name.toLowerCase().startsWith('on')) {
             this._reportError(
               attr,
               `Translating attribute '${name}' is disallowed for security reasons.`,
diff --git a/packages/core/test/linker/security_integration_spec.ts b/packages/core/test/linker/security_integration_spec.ts
@@ -376,6 +376,15 @@ describe('security integration tests', function () {
       expect(link.getAttribute('href')).toEqual('unsafe:javascript:alert(1)');
     });
 
+    it('should throw error on translated event attributes', () => {
+      const template = `<img src="/missing-image.png" onerror="void 0" i18n-onerror>`;
+      TestBed.overrideComponent(SecuredComponent, {set: {template}});
+
+      expect(() => TestBed.createComponent(SecuredComponent)).toThrowError(
+        /Translating attribute 'onerror' is disallowed for security reasons./,
+      );
+    });
+
     it('should throw error on security-sensitive attributes with constant values', () => {
       const template = `<iframe srcdoc="foo" i18n-srcdoc></iframe>`;
       TestBed.overrideComponent(SecuredComponent, {set: {template}});

Original file line number	Diff line number	Diff line change
`@@ -208,7 +208,7 @@ export class I18nMetaVisitor implements html.Visitor {`
`208`	`208`	`isTrustedType = isTrustedTypesSink(node.name, name);`
`209`	`209`	`}`
`210`	`210`
`211`		`- if (isTrustedType) {`
	`211`	`+ if (isTrustedType \|\| name.toLowerCase().startsWith('on')) {`
`212`	`212`	`this._reportError(`
`213`	`213`	`attr,`
`214`	`214`	`Translating attribute '${name}' is disallowed for security reasons.`,