fix(security): patch CVE-2026-11998 — SCE resource URL policy bypass (12/12)

[nmccready-tars]

Summary

Patches CVE-2026-11998 (High, CVSS 7.6), published 2026-06-24 — raised on PR #7 by @mattyb. Upstream AngularJS is EOL and will not fix it.

The bug

adjustMatcher() in src/ng/sce.js anchored user-supplied RegExp matchers as ^source$. With a top-level alternation the anchors bind to the outer alternatives only:

// resourceUrlWhitelist: [/https:\/\/a\.com|https:\/\/b\.com/]
// became: /^https:\/\/a\.com|https:\/\/b\.com$/
'https://a.com.evil.net/x.js'  // ✗ matched → loaded as a trusted script (XSS)

The fix

Wrap the source in a non-capturing group — ^(?:source)$ — so the anchors always apply to the whole expression. One line; string matchers ('self', wildcard patterns) are unaffected since escaping makes alternation impossible there.

Changes

• src/ng/sce.js — anchor fix + CVE marker comment
• test/ng/sceSpecs.js — regression tests (alternation bypass blocked, legit URLs still match, plain/pre-anchored regexes unchanged)
• .github/workflows/ci.yml — verify the marker survives into built output (same pattern as the other 11)
• README.md — badge + table now 12/12 (3 HIGH, 9 MEDIUM)
• angular.js, angular.min.js, .map — rebuilt dist

Notes for reviewer

• README row says "Fixed in 1.10.3+" assuming next patch release is 1.10.3 — adjust if you version differently.
• SECURITY.md is still the stock upstream file even though the README links to it for "full details" — worth a follow-up.

🤖 Generated with Claude Code