fix(security): align SVG, i18n, and host-binding sinks with Angular v22

crates/oxc_angular_compiler/src/ast/html.rs

@@ -125,6 +125,9 @@ pub struct HtmlElement<'a> {
     /// Whether this is a void element (area, base, br, col, embed, hr, img, input, link, meta, param, source, track, wbr).
     /// Void elements cannot have content and do not have end tags.
     pub is_void: bool,
+    /// Parsed from a selectorless component tag (`<MyComp>`, `<MyComp:iframe>`).
+    /// The class is `name`; the host element is `component_prefix` / `component_tag_name`.
+    pub is_component: bool,
 }
 
 /// A selectorless component in the HTML AST.
@@ -518,6 +521,7 @@ mod tests {
             end_span: None,
             is_self_closing: false,
             is_void: false,
+            is_component: false,
         };
 
         let child2 = HtmlElement {
@@ -532,6 +536,7 @@ mod tests {
             end_span: None,
             is_self_closing: false,
             is_void: false,
+            is_component: false,
         };
 
         let mut children = Vec::new_in(&&allocator);
@@ -550,6 +555,7 @@ mod tests {
             end_span: None,
             is_self_closing: false,
             is_void: false,
+            is_component: false,
         };
 
         let mut nodes = Vec::new_in(&&allocator);

crates/oxc_angular_compiler/src/component/transform.rs

@@ -3701,8 +3701,10 @@ fn compile_component_full<'a>(
     };
 
     // Stage 2: Transform HTML to R3 AST
-    let r3_transform_options =
-        R3TransformOptions { collect_comment_nodes: parse_options.collect_comment_nodes };
+    let r3_transform_options = R3TransformOptions {
+        collect_comment_nodes: parse_options.collect_comment_nodes,
+        angular_version: options.angular_version,
+    };
     let transformer = HtmlToR3Transform::new(allocator, template, r3_transform_options);
     let r3_result = transformer.transform(nodes);
 
@@ -4161,8 +4163,10 @@ pub fn compile_component_template<'a>(
     };
 
     // Stage 2: Transform HTML to R3 AST
-    let r3_transform_options =
-        R3TransformOptions { collect_comment_nodes: parse_options.collect_comment_nodes };
+    let r3_transform_options = R3TransformOptions {
+        collect_comment_nodes: parse_options.collect_comment_nodes,
+        angular_version: None,
+    };
     let transformer = HtmlToR3Transform::new(allocator, template, r3_transform_options);
     let r3_result = transformer.transform(nodes);
 
@@ -4258,8 +4262,10 @@ pub fn compile_template_to_js_with_options<'a>(
     };
 
     // Stage 2: Transform HTML to R3 AST
-    let r3_transform_options =
-        R3TransformOptions { collect_comment_nodes: parse_options.collect_comment_nodes };
+    let r3_transform_options = R3TransformOptions {
+        collect_comment_nodes: parse_options.collect_comment_nodes,
+        angular_version: options.angular_version,
+    };
     let transformer = HtmlToR3Transform::new(allocator, template, r3_transform_options);
     let r3_result = transformer.transform(nodes);
 
@@ -4433,8 +4439,10 @@ pub fn compile_template_for_hmr<'a>(
     };
 
     // Stage 2: Transform HTML to R3 AST
-    let r3_transform_options =
-        R3TransformOptions { collect_comment_nodes: parse_options.collect_comment_nodes };
+    let r3_transform_options = R3TransformOptions {
+        collect_comment_nodes: parse_options.collect_comment_nodes,
+        angular_version: options.angular_version,
+    };
     let transformer = HtmlToR3Transform::new(allocator, template, r3_transform_options);
     let r3_result = transformer.transform(nodes);
 
@@ -5132,8 +5140,10 @@ pub fn compile_template_for_linker<'a>(
     };
 
     // Stage 2: Transform HTML to R3 AST
-    let r3_transform_options =
-        R3TransformOptions { collect_comment_nodes: parse_options.collect_comment_nodes };
+    let r3_transform_options = R3TransformOptions {
+        collect_comment_nodes: parse_options.collect_comment_nodes,
+        angular_version: None,
+    };
     let transformer = HtmlToR3Transform::new(allocator, template, r3_transform_options);
     let r3_result = transformer.transform(nodes);
 

crates/oxc_angular_compiler/src/directive/compiler.rs

@@ -30,7 +30,7 @@ use crate::output::ast::{
 };
 use crate::parser::expression::BindingParser;
 use crate::pipeline::emit::{HostBindingCompilationResult, compile_host_bindings};
-use crate::pipeline::ingest::{HostBindingInput, ingest_host_binding};
+use crate::pipeline::ingest::{HostBindingInput, ingest_host_binding_with_version};
 use crate::pipeline::selector::{
     parse_selector_to_r3_selector as parse_css_to_r3, r3_selector_to_output_expr,
 };
@@ -163,9 +163,12 @@ fn build_base_directive_fields<'a>(
     // - hostVars: number of host variables (only if > 0)
     // - hostBindings: the host binding function
     if metadata.host.has_bindings() {
-        if let Some((result, new_pool_index)) =
-            compile_directive_host_bindings(allocator, metadata, pool_starting_index)
-        {
+        if let Some((result, new_pool_index)) = compile_directive_host_bindings(
+            allocator,
+            metadata,
+            pool_starting_index,
+            angular_version,
+        ) {
             next_pool_index = new_pool_index;
 
             // hostAttrs: [...] - static host attributes
@@ -562,6 +565,7 @@ fn compile_directive_host_bindings<'a>(
     allocator: &'a Allocator,
     metadata: &R3DirectiveMetadata<'a>,
     pool_starting_index: u32,
+    angular_version: Option<crate::AngularVersion>,
 ) -> Option<(HostBindingCompilationResult<'a>, u32)> {
     let host = &metadata.host;
 
@@ -580,7 +584,13 @@ fn compile_directive_host_bindings<'a>(
 
     // Ingest and compile the host bindings using the IR pipeline
     // Use the provided pool_starting_index to continue from where previous compilations left off
-    let mut job = ingest_host_binding(allocator, input, pool_starting_index);
+    let mut job = ingest_host_binding_with_version(
+        allocator,
+        input,
+        pool_starting_index,
+        angular_version,
+        None,
+    );
     let result = compile_host_bindings(&mut job);
 
     // Get the next pool index after host binding compilation