fix(security): emit validateIframeAttribute on legacy targets

Upstream resolve_sanitizers.ts falls back to ɵɵvalidateIframeAttribute
when a Property/Attribute/DomProperty op on an iframe got no sanitizer
from its security context. The path exists on versions without the
iframe attributeNoBinding schema keys (removed upstream in 19.2.17 /
20.3.15 / 21.0.2), so gate it to the legacy schema.

Also pass angular_version into TransformOptions in the integration test
helper so version-targeted tests compile templates against the matching
security schema.

Author: Brooooooklyn

crates/oxc_angular_compiler/src/pipeline/phases/resolve_sanitizers.rs

@@ -7,11 +7,13 @@
 //! Ported from Angular's `template/pipeline/src/phases/resolve_sanitizers.ts`.
 
 use oxc_str::Ident;
+use rustc_hash::FxHashMap;
 
 use crate::ast::r3::SecurityContext;
-use crate::ir::ops::{CreateOp, UpdateOp};
+use crate::ir::ops::{CreateOp, UpdateOp, XrefId};
 use crate::pipeline::compilation::{ComponentCompilationJob, HostBindingCompilationJob};
 use crate::r3::Identifiers;
+use crate::schema::{is_iframe_security_sensitive_attr, uses_iframe_attr_validation};
 
 /// Map a security context to its sanitizer function name.
 fn get_sanitizer_fn(security_context: SecurityContext) -> Option<&'static str> {
@@ -45,12 +47,74 @@ fn get_trusted_value_fn(security_context: SecurityContext) -> Option<&'static st
     }
 }
 
+/// The element-or-container create ops upstream indexes with
+/// `createOpXrefMap`, reduced to what the iframe fallback reads: whether the
+/// owner op is an `elementStart` whose tag is `iframe`.
+///
+/// Upstream's `isIframeElement` checks `op.kind === OpKind.ElementStart`, so
+/// self-closing `element()` ops are intentionally not matched.
+fn create_op_xref_map<'a>(ops: impl Iterator<Item = &'a CreateOp<'a>>) -> FxHashMap<XrefId, bool> {
+    let mut elements = FxHashMap::default();
+    for op in ops {
+        let (xref, is_iframe) = match op {
+            CreateOp::ElementStart(op) => (op.xref, op.tag.as_str().eq_ignore_ascii_case("iframe")),
+            CreateOp::Element(op) => (op.xref, false),
+            CreateOp::ContainerStart(op) => (op.xref, false),
+            CreateOp::Container(op) => (op.xref, false),
+            CreateOp::Template(op) => (op.xref, false),
+            CreateOp::Conditional(op) => (op.xref, false),
+            CreateOp::ConditionalBranch(op) => (op.xref, false),
+            CreateOp::RepeaterCreate(op) => {
+                // Upstream indexes the `@empty` view under the same repeater op.
+                if let Some(empty_view) = op.empty_view {
+                    elements.insert(empty_view, false);
+                }
+                (op.xref, false)
+            }
+            _ => continue,
+        };
+        elements.insert(xref, is_iframe);
+    }
+    elements
+}
+
+/// Apply upstream's legacy `ɵɵvalidateIframeAttribute` fallback: when a
+/// `Property` / `Attribute` / `DomProperty` op got no sanitizer from its
+/// security context, a security-sensitive iframe attribute gets the runtime
+/// validator. Removed upstream once the schema's `attributeNoBinding` iframe
+/// keys covered the same attributes (19.2.17 / 20.3.15 / 21.0.2).
+fn resolve_iframe_sanitizer(
+    assume_iframe: bool,
+    elements: &FxHashMap<XrefId, bool>,
+    target: XrefId,
+    name: &str,
+    sanitizer: &mut Option<Ident<'_>>,
+) {
+    if sanitizer.is_some() {
+        return;
+    }
+    // For host bindings and `DomProperty` ops the element is not known at
+    // compile time, so upstream assumes it may be an iframe; the emitted
+    // validator checks the real tag at runtime.
+    let is_iframe = if assume_iframe {
+        true
+    } else {
+        *elements
+            .get(&target)
+            .unwrap_or_else(|| panic!("Property should have an element-like owner"))
+    };
+    if is_iframe && is_iframe_security_sensitive_attr(name) {
+        *sanitizer = Some(Ident::from(Identifiers::VALIDATE_IFRAME_ATTRIBUTE));
+    }
+}
+
 /// Resolves security sanitizers for property bindings.
 ///
 /// This phase:
 /// 1. For ExtractedAttribute ops (constant attributes), sets the trusted value function
 /// 2. For Property, Attribute, and DomProperty ops, sets the sanitizer function
 pub fn resolve_sanitizers(job: &mut ComponentCompilationJob<'_>) {
+    let iframe_validation = uses_iframe_attr_validation(job.angular_version);
     // Collect view xrefs to avoid borrow issues
     let view_xrefs: Vec<_> = job.all_views().map(|v| v.xref).collect();
 
@@ -65,23 +129,52 @@ pub fn resolve_sanitizers(job: &mut ComponentCompilationJob<'_>) {
                 }
             }
 
+            let elements = iframe_validation.then(|| create_op_xref_map(view.create.iter()));
+
             // Process update ops - set sanitizers for property/attribute bindings
             for op in view.update.iter_mut() {
                 match op {
                     UpdateOp::Property(prop) => {
                         if let Some(fn_name) = get_sanitizer_fn(prop.security_context) {
                             prop.sanitizer = Some(Ident::from(fn_name));
                         }
+                        if let Some(elements) = &elements {
+                            resolve_iframe_sanitizer(
+                                false,
+                                elements,
+                                prop.target,
+                                prop.name.as_str(),
+                                &mut prop.sanitizer,
+                            );
+                        }
                     }
                     UpdateOp::Attribute(attr) => {
                         if let Some(fn_name) = get_sanitizer_fn(attr.security_context) {
                             attr.sanitizer = Some(Ident::from(fn_name));
                         }
+                        if let Some(elements) = &elements {
+                            resolve_iframe_sanitizer(
+                                false,
+                                elements,
+                                attr.target,
+                                attr.name.as_str(),
+                                &mut attr.sanitizer,
+                            );
+                        }
                     }
                     UpdateOp::DomProperty(dom_prop) => {
                         if let Some(fn_name) = get_sanitizer_fn(dom_prop.security_context) {
                             dom_prop.sanitizer = Some(Ident::from(fn_name));
                         }
+                        if let Some(elements) = &elements {
+                            resolve_iframe_sanitizer(
+                                true,
+                                elements,
+                                dom_prop.target,
+                                dom_prop.name.as_str(),
+                                &mut dom_prop.sanitizer,
+                            );
+                        }
                     }
                     _ => {}
                 }
@@ -94,6 +187,8 @@ pub fn resolve_sanitizers(job: &mut ComponentCompilationJob<'_>) {
 ///
 /// Host version - only processes the root unit (no embedded views).
 pub fn resolve_sanitizers_for_host(job: &mut HostBindingCompilationJob<'_>) {
+    let iframe_validation = uses_iframe_attr_validation(job.angular_version);
+
     // Process create ops - set trusted value functions for extracted attributes
     for op in job.root.create.iter_mut() {
         if let CreateOp::ExtractedAttribute(attr) = op {
@@ -105,23 +200,31 @@ pub fn resolve_sanitizers_for_host(job: &mut HostBindingCompilationJob<'_>) {
 
     // Process update ops - set sanitizers for property/attribute bindings
     for op in job.root.update.iter_mut() {
-        match op {
+        let (name, sanitizer) = match op {
             UpdateOp::Property(prop) => {
                 if let Some(fn_name) = get_sanitizer_fn(prop.security_context) {
                     prop.sanitizer = Some(Ident::from(fn_name));
                 }
+                (prop.name.as_str(), &mut prop.sanitizer)
             }
             UpdateOp::Attribute(attr) => {
                 if let Some(fn_name) = get_sanitizer_fn(attr.security_context) {
                     attr.sanitizer = Some(Ident::from(fn_name));
                 }
+                (attr.name.as_str(), &mut attr.sanitizer)
             }
             UpdateOp::DomProperty(dom_prop) => {
                 if let Some(fn_name) = get_sanitizer_fn(dom_prop.security_context) {
                     dom_prop.sanitizer = Some(Ident::from(fn_name));
                 }
+                (dom_prop.name.as_str(), &mut dom_prop.sanitizer)
             }
-            _ => {}
+            _ => continue,
+        };
+        // A host job cannot know its host element at compile time, so upstream
+        // assumes iframe and defers the tag check to the runtime validator.
+        if iframe_validation && sanitizer.is_none() && is_iframe_security_sensitive_attr(name) {
+            *sanitizer = Some(Ident::from(Identifiers::VALIDATE_IFRAME_ATTRIBUTE));
         }
     }
 }

crates/oxc_angular_compiler/src/r3/identifiers.rs

@@ -912,6 +912,9 @@ impl Identifiers {
     /// Validate attribute.
     pub const VALIDATE_ATTRIBUTE: &'static str = "ɵɵvalidateAttribute";
 
+    /// Validate iframe attribute.
+    pub const VALIDATE_IFRAME_ATTRIBUTE: &'static str = "ɵɵvalidateIframeAttribute";
+
     /// Sanitize resource URL.
     pub const SANITIZE_RESOURCE_URL: &'static str = "ɵɵsanitizeResourceUrl";
 

crates/oxc_angular_compiler/tests/integration_test.rs

@@ -41,7 +41,11 @@ fn compile_template_to_js_with_version(
     }
 
     // Stage 2: Transform HTML AST to R3 AST
-    let transformer = HtmlToR3Transform::new(&allocator, template, TransformOptions::default());
+    let transformer = HtmlToR3Transform::new(
+        &allocator,
+        template,
+        TransformOptions { angular_version, ..TransformOptions::default() },
+    );
     let r3_result = transformer.transform(&html_result.nodes);
 
     // Check for transform errors
@@ -10337,6 +10341,61 @@ fn test_property_singleton_interpolation_with_sanitizer_angular_v19() {
     insta::assert_snapshot!("property_singleton_interpolation_with_sanitizer_v19", js);
 }
 
+#[test]
+fn test_iframe_sensitive_attr_validation_legacy_versions() {
+    // Upstream resolve_sanitizers.ts falls back to ɵɵvalidateIframeAttribute for
+    // security-sensitive iframe attributes that got no sanitizer. It existed on
+    // versions before the iframe attributeNoBinding schema keys (removed in
+    // 19.2.17 / 20.3.15 / 21.0.2).
+    for version in [AngularVersion::new(19, 0, 0), AngularVersion::new(21, 0, 1)] {
+        let js = compile_template_to_js_with_version(
+            r#"<iframe [sandbox]="expr"></iframe>"#,
+            "TestComponent",
+            Some(version),
+        );
+        assert!(
+            js.contains("ɵɵvalidateIframeAttribute"),
+            "v{version:?} should emit ɵɵvalidateIframeAttribute for iframe [sandbox]. Got:\n{js}"
+        );
+    }
+    // Once the schema covers iframe|sandbox as attributeNoBinding, the generic
+    // ɵɵvalidateAttribute is used instead.
+    for version in [AngularVersion::new(19, 2, 17), AngularVersion::new(21, 0, 2)] {
+        let js = compile_template_to_js_with_version(
+            r#"<iframe [sandbox]="expr"></iframe>"#,
+            "TestComponent",
+            Some(version),
+        );
+        assert!(
+            js.contains("ɵɵvalidateAttribute"),
+            "v{version:?} should emit ɵɵvalidateAttribute for iframe [sandbox]. Got:\n{js}"
+        );
+        assert!(
+            !js.contains("ɵɵvalidateIframeAttribute"),
+            "v{version:?} should not emit the legacy iframe validator. Got:\n{js}"
+        );
+    }
+    // The validator only applies to iframes and only to the sensitive attrs.
+    let js = compile_template_to_js_with_version(
+        r#"<div [sandbox]="expr"></div>"#,
+        "TestComponent",
+        Some(AngularVersion::new(21, 0, 1)),
+    );
+    assert!(
+        !js.contains("ɵɵvalidateIframeAttribute"),
+        "Non-iframe host should not get the iframe validator. Got:\n{js}"
+    );
+    let js = compile_template_to_js_with_version(
+        r#"<iframe [title]="expr"></iframe>"#,
+        "TestComponent",
+        Some(AngularVersion::new(21, 0, 1)),
+    );
+    assert!(
+        !js.contains("ɵɵvalidateIframeAttribute"),
+        "Non-sensitive attribute should not get the iframe validator. Got:\n{js}"
+    );
+}
+
 // ============================================================================
 // Host Directive Alias Tests
 // ============================================================================