Merge clarification of non-applicability of known vulnerabilities in AngularJS.

Author: necouchman

_angularjs-cves/CVE-2022-25844.md

@@ -0,0 +1,8 @@
+---
+title: Regular Expression Denial of Service (ReDoS)
+cve:   CVE-2022-25844
+---
+
+This is a potential regular expression denial of service in AngularJS' handling
+of locale rules. This cannot affect Guacamole, which does not construct locale
+rules with untrusted data.

_angularjs-cves/CVE-2022-25869.md

@@ -0,0 +1,9 @@
+---
+title: Angular (deprecated package) Cross-site Scripting
+cve:   CVE-2022-25869
+---
+
+This vulnerability is specific to Internet Explorer and its potentially
+insecure caching of `<textarea>` element contents. This cannot affect
+Guacamole, which does not load `<textarea>` elements in a way that Internet
+Explorer is capable of caching.

_angularjs-cves/CVE-2023-26116.md

@@ -0,0 +1,8 @@
+---
+title: angular vulnerable to regular expression denial of service via the angular.copy() utility
+cve:   CVE-2023-26116
+---
+
+This is a potential regular expression denial of service in AngularJS'
+`angular.copy()` utility function. This cannot affect Guacamole, which does not
+pass untrusted data to this function.

_angularjs-cves/CVE-2023-26117.md

@@ -0,0 +1,8 @@
+---
+title: angular vulnerable to regular expression denial of service via the $resource service
+cve:   CVE-2023-26117
+---
+
+This is a potential regular expression denial of service in AngularJS'
+`$resource` service. This cannot affect Guacamole, which does not make use of
+the `$resource` service, let alone pass untrusted data to it.

_angularjs-cves/CVE-2023-26118.md

@@ -0,0 +1,8 @@
+---
+title: angular vulnerable to regular expression denial of service via the <input type="url"> element
+cve:   CVE-2023-26118
+---
+
+This is a potential regular expression denial of service in AngularJS' handling
+of `<input type="url">` elements. This cannot affect Guacamole, which does not
+use these elements.

_angularjs-cves/CVE-2024-21490.md

@@ -0,0 +1,8 @@
+---
+title: angular vulnerable to super-linear runtime due to backtracking
+cve:   CVE-2024-21490
+---
+
+This is a potential regular expression denial of service in AngularJS'
+`ng-srcset` directive. This cannot affect Guacamole which does not use this
+directive, let alone pass untrusted data to it.

_angularjs-cves/CVE-2024-8372.md

@@ -0,0 +1,8 @@
+---
+title: AngularJS improper sanitization in 'srcset' attribute
+cve:   CVE-2024-8372
+---
+
+This is a potential bypass of AngularJS' image source restriction capabilities
+specific to the `srcset` attribute. This cannot affect Guacamole, which does
+not rely on AngularJS to restrict image sources.

_angularjs-cves/CVE-2024-8373.md

@@ -0,0 +1,8 @@
+---
+title: AngularJS improper sanitization in '<source>' element
+cve:   CVE-2024-8373
+---
+
+This is a potential bypass of AngularJS' image source restriction capabilities
+specific to the `srcset` attribute of `<source>` elements. This cannot affect
+Guacamole, which does not rely on AngularJS to restrict image sources.

_angularjs-cves/CVE-2025-0716.md

@@ -0,0 +1,9 @@
+---
+title: AngularJS improper sanitization in SVG '<image>' element
+cve:   CVE-2025-0716
+---
+
+This is a potential bypass of AngularJS' image source restriction capabilities
+specific to the `href` and `xlink:href` attributes of `<image>` tags within SVG
+content. This cannot affect Guacamole, which does not rely on AngularJS to
+restrict image sources.

_config.yml

@@ -67,6 +67,10 @@ collections:
     security:
         output: false
 
+    # Known vulnerabilities in AngularJS
+    angularjs-cves:
+        output: false
+
 # Site-wide defaults
 defaults: