Thanks to visit codestin.com
Credit goes to github.com

Skip to content

fix(compiler): sanitize two-way properties - #69107

Merged
atscott merged 1 commit into
angular:mainfrom
SkyZeroZx:fix/two-way-databinding-sanitizer
Jun 8, 2026
Merged

fix(compiler): sanitize two-way properties#69107
atscott merged 1 commit into
angular:mainfrom
SkyZeroZx:fix/two-way-databinding-sanitizer

Conversation

@SkyZeroZx

@SkyZeroZx SkyZeroZx commented Jun 3, 2026

Copy link
Copy Markdown
Contributor

Apply schema-derived sanitizer resolution to TwoWayProperty ops so native two-way DOM bindings emit the same sanitizer as one-way property bindings.

Add compiler compliance coverage for innerHTML, srcdoc, URL, resource URL, and security-sensitive attribute cases.

@SkyZeroZx
fix(compiler): sanitize two-way properties
9ca51ab 
Apply schema-derived sanitizer resolution to TwoWayProperty ops so native two-way DOM bindings emit the same sanitizer as one-way property bindings.

Add compiler compliance coverage for innerHTML, srcdoc, URL, resource URL, and security-sensitive attribute cases.
@angular-robot angular-robot Bot added the area: compiler Issues related to `ngc`, Angular's template compiler label Jun 3, 2026
@ngbot ngbot Bot added this to the Backlog milestone Jun 3, 2026
@SkyZeroZx
SkyZeroZx marked this pull request as ready for review June 3, 2026 04:40
@pullapprove
pullapprove Bot requested a review from JoostK June 3, 2026 04:40
JeanMeche
JeanMeche approved these changes Jun 3, 2026
View reviewed changes

@JeanMeche JeanMeche left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That's a good catch

@JeanMeche JeanMeche added security Issues that generally impact framework or application security target: patch This PR is targeted for the next patch release target: rc This PR is targeted for the next release-candidate action: global presubmit The PR is in need of a google3 global presubmit and removed target: rc This PR is targeted for the next release-candidate labels Jun 3, 2026
@JeanMeche

JeanMeche commented Jun 3, 2026

Copy link
Copy Markdown
Member

Running TGP

This was referenced Jun 3, 2026
Merged
Merged
@JeanMeche

JeanMeche commented Jun 5, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

Caretaker note: TGP is passing, Presubmit errors are flakes. This is good to go

@JeanMeche JeanMeche added action: merge The PR is ready for merge by the caretaker and removed action: global presubmit The PR is in need of a google3 global presubmit labels Jun 5, 2026
@ngbot

ngbot Bot commented Jun 5, 2026

Copy link
Copy Markdown

I see that you just added the action: merge label, but the following checks are still failing:
    failure status "google-internal-tests" is failing
    pending status "mergeability" is pending

If you want your PR to be merged, it has to pass all the CI checks.

If you can't get the PR to a green state due to flakes or broken main, please try rebasing to main and/or restarting the CI job. If that fails and you believe that the issue is not due to your change, please contact the caretaker and ask for help.

@JeanMeche JeanMeche added the merge: caretaker note Alert the caretaker performing the merge to check the PR for an out of normal action needed or note label Jun 5, 2026
@atscott
atscott merged commit 3c70270 into angular:main Jun 8, 2026
32 of 34 checks passed
@atscott

atscott commented Jun 8, 2026

Copy link
Copy Markdown
Contributor

This PR was merged into the repository. The changes were merged into the following branches:

@github-actions github-actions Bot mentioned this pull request Jun 8, 2026
Open
@angular-automatic-lock-bot

angular-automatic-lock-bot Bot commented Jul 9, 2026

Copy link
Copy Markdown

This pull request has been automatically locked due to inactivity.
Please file a new issue if you are encountering a similar or related problem.

Read more about our automatic conversation locking policy.

This action has been performed automatically by a bot.

@angular-automatic-lock-bot angular-automatic-lock-bot Bot locked and limited conversation to collaborators Jul 9, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Reviewers

@JoostK JoostK JoostK approved these changes
@JeanMeche JeanMeche JeanMeche approved these changes

Assignees

No one assigned

Labels

action: merge The PR is ready for merge by the caretaker area: compiler Issues related to `ngc`, Angular's template compiler merge: caretaker note Alert the caretaker performing the merge to check the PR for an out of normal action needed or note security Issues that generally impact framework or application security target: patch This PR is targeted for the next patch release

Projects

None yet

Milestone

Backlog

Development

Successfully merging this pull request may close these issues.

4 participants

@SkyZeroZx @JeanMeche @atscott @JoostK