fix(security): keep bare selectorless hosts on pre-v22 schemas

calcPossibleSecurityContexts only promotes an unknown bare selector to
:svg:/:math: form on the namespaced schema (20.3.22+, 21.2.14+, v22).
Promoting unconditionally made <MyComp:animate [attr.to]> miss the bare
animate|to key on 21.2.7-21.2.13, dropping ɵɵvalidateAttribute. Gate the
promotion on the schema kind; host tags pass through verbatim on earlier
versions, matching upstream.

Author: Brooooooklyn

crates/oxc_angular_compiler/src/schema/dom_security_schema.rs

@@ -128,6 +128,13 @@ pub fn strips_namespaced_svg_style(version: Option<crate::AngularVersion>) -> bo
     security_profile(version).strip_svg_style
 }
 
+/// Whether this Angular version's schema keys keep `:svg:` / `:math:` prefixes.
+/// `calcPossibleSecurityContexts` only promotes bare selector elements to
+/// their `:svg:` / `:math:` forms on the namespaced schema.
+pub fn uses_namespaced_schema(version: Option<crate::AngularVersion>) -> bool {
+    security_profile(version).namespaced
+}
+
 /// Whether i18n must reject `iframe` `src` as a Trusted Types sink.
 pub fn rejects_iframe_src_i18n(version: Option<crate::AngularVersion>) -> bool {
     security_profile(version).iframe_src_i18n

crates/oxc_angular_compiler/src/schema/mod.rs

@@ -10,5 +10,6 @@ pub use dom_security_schema::{
     calc_security_context_for_unknown_element, get_security_context, get_security_context_for,
     host_binding_security_context, host_binding_security_context_for, is_known_element,
     rejects_iframe_src_i18n, strips_namespaced_svg_script, strips_namespaced_svg_style,
+    uses_namespaced_schema,
 };
 pub use trusted_types_sinks::{is_trusted_types_sink, is_trusted_types_sink_at};

crates/oxc_angular_compiler/src/transform/html_to_r3.rs

@@ -32,7 +32,7 @@ use crate::parser::expression::{BindingParser, find_comment_start};
 use crate::parser::html::{decode_entities_in_string, get_html_tag_definition, split_ns_name};
 use crate::schema::{
     get_security_context_for, is_known_element, is_trusted_types_sink_at,
-    strips_namespaced_svg_script, strips_namespaced_svg_style,
+    strips_namespaced_svg_script, strips_namespaced_svg_style, uses_namespaced_schema,
 };
 use crate::transform::control_flow::{parse_conditional_params, parse_defer_triggers};
 use crate::util::ParseError;
@@ -341,7 +341,7 @@ impl<'a> HtmlToR3Transform<'a> {
             Self::resolve_element_name(raw_name, parent_prefix)
         };
         let security_name = if element.is_component {
-            Self::component_security_name(host_tag.as_deref())
+            Self::component_security_name(host_tag.as_deref(), self.angular_version)
         } else {
             Self::security_lookup_name(&resolved_name)
         };
@@ -728,7 +728,8 @@ impl<'a> HtmlToR3Transform<'a> {
 
         // `tagName === null` is not a Trusted Types sink. `full_name` is the class.
         let i18n_element_name = host_tag.as_deref();
-        let security_name = Self::component_security_name(host_tag.as_deref());
+        let security_name =
+            Self::component_security_name(host_tag.as_deref(), self.angular_version);
         let (attributes, inputs, outputs, references, _variables, template_attr) =
             self.parse_attributes(&component.attrs, &security_name, i18n_element_name, false);
 
@@ -916,15 +917,19 @@ impl<'a> HtmlToR3Transform<'a> {
     /// Security-schema name for a selectorless component, matching
     /// `calcPossibleSecurityContexts(component.tagName, ...)`.
     ///
-    /// A bare host tag that is not an HTML element is rewritten to its known
-    /// `:svg:`/`:math:` form (`animate` → `:svg:animate`). `tagName === null`
-    /// resolves over every known element upstream; the empty name reproduces
-    /// that through the `*|attr` fallback (`src` → `NONE`, `innerHTML` →
-    /// `HTML`).
-    fn component_security_name(host_tag: Option<&str>) -> String {
+    /// On the namespaced schema a bare host tag that is not an HTML element is
+    /// rewritten to its known `:svg:`/`:math:` form (`animate` →
+    /// `:svg:animate`); pre-v22 versions look up the bare tag (`animate|to`).
+    /// `tagName === null` resolves over every known element upstream; the empty
+    /// name reproduces that through the `*|attr` fallback (`src` → `NONE`,
+    /// `innerHTML` → `HTML`).
+    fn component_security_name(host_tag: Option<&str>, version: Option<AngularVersion>) -> String {
         let Some(tag) = host_tag else {
             return String::new();
         };
+        if !uses_namespaced_schema(version) {
+            return tag.to_string();
+        }
         let lower = tag.to_ascii_lowercase();
         let (ns, local) = split_ns_name(&lower);
         if ns.is_none() && !is_known_element(local) {
@@ -5373,4 +5378,41 @@ mod security_tests {
             "{contexts:?}"
         );
     }
+
+    #[test]
+    fn selectorless_bare_host_stays_bare_before_the_namespaced_schema() {
+        // Pre-v22 `calcPossibleSecurityContexts` looks the bare tag up:
+        // `animate|to` is `AttributeNoBinding` on 21.2.7 while `:svg:animate|to`
+        // is not a key.
+        let (_, contexts, _) = compile_selectorless_at(
+            r#"<MyComp:animate [attr.to]="value"></MyComp:animate>"#,
+            Some(AngularVersion::new(21, 2, 7)),
+        );
+        assert!(
+            contexts
+                .iter()
+                .any(|(name, ctx)| name == "to" && *ctx == SecurityContext::AttributeNoBinding),
+            "{contexts:?}"
+        );
+
+        // Same for bare MathML hosts: `mi|href` is a bare URL key pre-v22.
+        let (_, contexts, _) = compile_selectorless_at(
+            r#"<MyComp:mi [attr.href]="value"></MyComp:mi>"#,
+            Some(AngularVersion::new(21, 2, 7)),
+        );
+        assert!(
+            contexts.iter().any(|(name, ctx)| name == "href" && *ctx == SecurityContext::Url),
+            "{contexts:?}"
+        );
+
+        // v22 promotes the bare host to `:svg:animate` like upstream.
+        let (_, contexts, _) =
+            compile_selectorless(r#"<MyComp:animate [attr.to]="value"></MyComp:animate>"#);
+        assert!(
+            contexts
+                .iter()
+                .any(|(name, ctx)| name == "to" && *ctx == SecurityContext::AttributeNoBinding),
+            "{contexts:?}"
+        );
+    }
 }