Skip to content

fix(security): close SVG/i18n security-context gaps vs @angular/compiler v21.2.7 #334

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Brooooooklyn wants to merge 5 commits into
base: main
Choose a base branch
from
Open

fix(security): close SVG/i18n security-context gaps vs @angular/compiler v21.2.7 #334

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
71e76a5
test(conformance): regenerate v21.2.7 fixtures + snapshot
Brooooooklyn Jun 2, 2026
a2806b8
fix(security): close SVG/i18n security-context gaps vs @angular/compi…
Brooooooklyn Jun 2, 2026
b8058ef
Merge branch 'main' into fix/issue-315-security-contexts
brandonroberts Jun 3, 2026
683d285
fix(selectorless): skip script/style/link preparser for components
Brooooooklyn Aug 11, 2026
626d83b
fix(conformance): restore v21.2.7 data- bindings after main merge
Brooooooklyn Aug 11, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
40 changes: 40 additions & 0 deletions crates/angular_conformance/fixtures/ml_parser_html_parser_spec.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -112,6 +112,28 @@
}
]
},
{
"name": "should parse named HTML entities containing digits",
"path": "HtmlParser/parse/text nodes/should parse named HTML entities containing digits",
"assertions": [
{
"type": "HumanizeDom",
"input": "<div>&sup1;</div>",
"expected": [
["html.Element", "div", 0.0],
["html.Text", "¹", 1.0, [""], ["¹", "&sup1;"], [""]]
]
},
{
"type": "HumanizeDom",
"input": "<div>&frac12;</div>",
"expected": [
["html.Element", "div", 0.0],
["html.Text", "½", 1.0, [""], ["½", "&frac12;"], [""]]
]
}
]
},
{
"name": "should normalize line endings within CDATA",
"path": "HtmlParser/parse/text nodes/should normalize line endings within CDATA",
Expand Down Expand Up @@ -995,6 +1017,24 @@
}
]
},
{
"name": "should parse exhaustive default checks in a switch block",
"path": "HtmlParser/parse/blocks/should parse exhaustive default checks in a switch block",
"assertions": [
{
"type": "HumanizeDom",
"input": "@switch (expr) {@case ('foo') {} @default never;}",
"expected": [
["html.Block", "switch", 0.0],
["html.BlockParameter", "expr"],
["html.Block", "case", 1.0],
["html.BlockParameter", "'foo'"],
["html.Text", " ", 1.0, [" "]],
["html.Block", "default never", 1.0]
]
}
]
},
{
"name": "should close void elements used right before a block",
"path": "HtmlParser/parse/blocks/should close void elements used right before a block",
Expand Down
61 changes: 42 additions & 19 deletions crates/angular_conformance/fixtures/ml_parser_lexer_spec.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3154,6 +3154,48 @@
}
]
},
{
"name": "should parse named entities containing digits",
"path": "HtmlLexer/entities/should parse named entities containing digits",
"assertions": [
{
"type": "HtmlLexerTest",
"input": "&sup1;",
"test_type": "HumanizeParts",
"expected": [
["TokenType.TEXT", ""],
["TokenType.ENCODED_ENTITY", "¹", "&sup1;"],
["TokenType.TEXT", ""],
["TokenType.EOF"]
],
"options": null
},
{
"type": "HtmlLexerTest",
"input": "&frac12;",
"test_type": "HumanizeParts",
"expected": [
["TokenType.TEXT", ""],
["TokenType.ENCODED_ENTITY", "½", "&frac12;"],
["TokenType.TEXT", ""],
["TokenType.EOF"]
],
"options": null
},
{
"type": "HtmlLexerTest",
"input": "&blk34;",
"test_type": "HumanizeParts",
"expected": [
["TokenType.TEXT", ""],
["TokenType.ENCODED_ENTITY", "▓", "&blk34;"],
["TokenType.TEXT", ""],
["TokenType.EOF"]
],
"options": null
}
]
},
{
"name": "should parse hexadecimal entities",
"path": "HtmlLexer/entities/should parse hexadecimal entities",
Expand Down Expand Up @@ -5046,25 +5088,6 @@
}
]
},
{
"name": "should parse @default never(expr);",
"path": "HtmlLexer/blocks/should parse @default never(expr);",
"assertions": [
{
"type": "HtmlLexerTest",
"input": "@default never(expr);",
"test_type": "HumanizeParts",
"expected": [
["TokenType.BLOCK_OPEN_START", "default never"],
["TokenType.BLOCK_PARAMETER", "expr"],
["TokenType.BLOCK_OPEN_END"],
["TokenType.BLOCK_CLOSE"],
["TokenType.EOF"]
],
"options": null
}
]
},
{
"name": "should parse @default never ;",
"path": "HtmlLexer/blocks/should parse @default never ;",
Expand Down
51 changes: 45 additions & 6 deletions crates/angular_conformance/fixtures/render3_r3_ast_spans_spec.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -164,7 +164,7 @@
"<div data-prop=\"{{v}}\">",
"</div>"
],
["BoundAttribute", "data-prop=\"{{v}}\"", "data-prop", "{{v}}"]
["BoundAttribute", "data-prop=\"{{v}}\"", "prop", "{{v}}"]
],
"ignore_error": false
}
Expand Down Expand Up @@ -345,7 +345,7 @@
"<ng-template data-ref-a>",
"</ng-template>"
],
["TextAttribute", "data-ref-a", "data-ref-a", "<empty>"]
["Reference", "data-ref-a", "a", "<empty>"]
],
"ignore_error": false
}
Expand Down Expand Up @@ -385,7 +385,7 @@
"<ng-template data-let-a=\"b\">",
"</ng-template>"
],
["TextAttribute", "data-let-a=\"b\"", "data-let-a", "b"]
["Variable", "data-let-a=\"b\"", "a", "b"]
],
"ignore_error": false
}
Expand Down Expand Up @@ -618,7 +618,7 @@
"<div data-on-event=\"v\">",
"</div>"
],
["TextAttribute", "data-on-event=\"v\"", "data-on-event", "v"]
["BoundEvent", "data-on-event=\"v\"", "event", "v"]
],
"ignore_error": false
}
Expand Down Expand Up @@ -675,7 +675,8 @@
"<div data-bindon-prop=\"v\">",
"</div>"
],
["TextAttribute", "data-bindon-prop=\"v\"", "data-bindon-prop", "v"]
["BoundAttribute", "data-bindon-prop=\"v\"", "prop", "v"],
["BoundEvent", "data-bindon-prop=\"v\"", "prop", "v"]
],
"ignore_error": false
}
Expand Down Expand Up @@ -751,6 +752,21 @@
"ignore_error": false
}
]
},
{
"name": "is correct for references via data-ref-",
"path": "R3 AST source spans/references/is correct for references via data-ref-",
"assertions": [
{
"type": "ExpectFromHtml",
"input": "<div ref-a></div>",
"expected": [
["Element", "<div ref-a></div>", "<div ref-a>", "</div>"],
["Reference", "ref-a", "a", "<empty>"]
],
"ignore_error": false
}
]
}
]
},
Expand Down Expand Up @@ -934,6 +950,29 @@
}
]
},
{
"name": "is correct for switch blocks with exhaustive checking",
"path": "R3 AST source spans/switch blocks/is correct for switch blocks with exhaustive checking",
"assertions": [
{
"type": "ExpectFromHtml",
"input": "@switch (cond.kind) {@case (x()) {X case}@default never;}",
"expected": [
[
"SwitchBlock",
"@switch (cond.kind) {@case (x()) {X case}@default never;}",
"@switch (cond.kind) {",
"}"
],
["SwitchBlockCaseGroup", "@case (x()) {X case}", "@case (x()) {"],
["SwitchBlockCase", "@case (x()) {X case}", "@case (x()) {"],
["Text", "X case"],
["SwitchExhaustiveCheck", "@default never;", "@default never;"]
],
"ignore_error": false
}
]
},
{
"name": "is correct for switch blocks with exhaustive checking",
"path": "R3 AST source spans/switch blocks/is correct for switch blocks with exhaustive checking",
Expand Down Expand Up @@ -1048,7 +1087,7 @@
{
"type": "ExpectFromHtml",
"input": "@let foo = 123;",
"expected": [["LetDeclaration", "@let foo = 123;", "foo", "123"]],
"expected": [["LetDeclaration", "@let foo = 123", "foo", "123"]],
"ignore_error": false
}
]
Expand Down
12 changes: 12 additions & 0 deletions crates/angular_conformance/fixtures/render3_r3_template_transform_spec.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2077,6 +2077,18 @@
}
]
},
{
"name": "should parse a switch block with a default never case",
"path": "R3 template transform/switch blocks/should parse a switch block with a default never case",
"assertions": [
{
"type": "ExpectFromHtml",
"input": "\n @switch (cond.kind) {\n @default never;\n }\n ",
"expected": [["SwitchBlock", "cond.kind"], ["SwitchExhaustiveCheck"]],
"ignore_error": false
}
]
},
{
"name": "should parse a switch block when preserveWhitespaces is enabled",
"path": "R3 template transform/switch blocks/should parse a switch block when preserveWhitespaces is enabled",
Expand Down
32 changes: 32 additions & 0 deletions crates/angular_conformance/fixtures/shadow_css_polyfills_spec.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,32 @@
{
"name": "polyfills_spec.ts",
"file_path": "/Users/brooklyn/workspace/github/oxc-angular-compiler/crates/oxc_angular_compiler/angular/packages/compiler/test/shadow_css/polyfills_spec.ts",
"test_groups": [
{
"name": "ShadowCss, polyfills",
"groups": [],
"tests": [
{
"name": "should support polyfill-next-selector",
"path": "ShadowCss, polyfills/should support polyfill-next-selector",
"assertions": []
},
{
"name": "should support polyfill-unscoped-rule",
"path": "ShadowCss, polyfills/should support polyfill-unscoped-rule",
"assertions": []
},
{
"name": "should support multiple instances polyfill-unscoped-rule",
"path": "ShadowCss, polyfills/should support multiple instances polyfill-unscoped-rule",
"assertions": []
},
{
"name": "should support polyfill-rule",
"path": "ShadowCss, polyfills/should support polyfill-rule",
"assertions": []
}
]
}
]
}
26 changes: 20 additions & 6 deletions crates/angular_conformance/fixtures/shadow_css_shadow_css_spec.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,10 +15,24 @@
"assertions": [
{
"type": "ShimCss",
"input": "/* b {} */ b {}",
"input": "/* b {c} */ b {c}",
"content_attr": "contenta",
"host_attr": null,
"expected": " b[contenta] {}",
"expected": " b[contenta] {c}",
"normalized": false
}
]
},
{
"name": "should preserve internal newlines from multiline comments",
"path": "ShadowCss/comments/should preserve internal newlines from multiline comments",
"assertions": [
{
"type": "ShimCss",
"input": "/* b {c}\n */ b {c}",
"content_attr": "contenta",
"host_attr": null,
"expected": "\n b[contenta] {c}",
"normalized": false
}
]
Expand All @@ -43,10 +57,10 @@
"assertions": [
{
"type": "ShimCss",
"input": "/* b {} */ b {} /* a {} */ a {}",
"input": "/* b {c} */ b {c} /* a {c} */ a {c}",
"content_attr": "contenta",
"host_attr": null,
"expected": " b[contenta] {} a[contenta] {}",
"expected": " b[contenta] {c} a[contenta] {c}",
"normalized": false
}
]
Expand Down Expand Up @@ -79,10 +93,10 @@
"assertions": [
{
"type": "ShimCss",
"input": "/* comment 1 */ /* comment 2 */ b {}",
"input": "/* comment 1 */ /* comment 2 */ b {c}",
"content_attr": "contenta",
"host_attr": null,
"expected": " b[contenta] {}",
"expected": " b[contenta] {c}",
"normalized": false
}
]
Expand Down
10 changes: 5 additions & 5 deletions crates/angular_conformance/snapshots/angular.snap.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,11 +9,11 @@
| expression_lexer | 137 | 0 | 0 | 0 | 137 | 100.0% |
| expression_parser | 270 | 0 | 0 | 0 | 270 | 100.0% |
| expression_serializer | 38 | 0 | 0 | 0 | 38 | 100.0% |
| html_lexer | 289 | 0 | 0 | 0 | 289 | 100.0% |
| html_parser | 87 | 0 | 0 | 0 | 87 | 100.0% |
| html_lexer | 291 | 0 | 0 | 0 | 291 | 100.0% |
| html_parser | 90 | 0 | 0 | 0 | 90 | 100.0% |
| html_whitespace | 21 | 0 | 0 | 0 | 21 | 100.0% |
| r3_transform | 177 | 0 | 0 | 0 | 177 | 100.0% |
| shadow_css | 169 | 0 | 0 | 0 | 169 | 100.0% |
| r3_transform | 180 | 0 | 0 | 0 | 180 | 100.0% |
| shadow_css | 170 | 0 | 0 | 0 | 170 | 100.0% |
| style_parser | 15 | 0 | 0 | 0 | 15 | 100.0% |
| **Total** | **1264** | **0** | **0** | **0** | **1264** | **100.0%** |
| **Total** | **1273** | **0** | **0** | **0** | **1273** | **100.0%** |

Loading
Loading