Repository navigation
Conversation
JeanMeche
force-pushed
the
fix-host-embedded-injector
branch
from
October 17, 2026 04:22
47359c1 to
9a87786
Compare
When an embedded view is created with a custom injector, the `HasEmbeddedViewInjector` flag is set on the view and inherited by descendant component views. When resolving tokens, `lookupTokenUsingEmbeddedInjector` walked up the view tree without checking `InternalInjectFlags.Host`, which allowed resolutions with `@Host()` to leak outside the host component into the custom injector and its parent injector hierarchy. Stop traversing parent nodes in `lookupTokenUsingEmbeddedInjector` once the host element node has been checked when `InternalInjectFlags.Host` is set. Fixes angular#57390
JeanMeche
force-pushed
the
fix-host-embedded-injector
branch
from
October 17, 2026 04:23
9a87786 to
479d589
Compare
JeanMeche
marked this pull request as ready for review
October 17, 2026 04:46
crisbeto
approved these changes
Oct 17, 2026
crisbeto
left a comment
Member
There was a problem hiding this comment.
LGTM, but we should do a TGP
Member
Author
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
PR Checklist
Please check if your PR fulfills the following requirements:
PR Type
What kind of change does this PR introduce?
What is the current behavior?
Issue Number: Fixes #57390
When an embedded view is created with a custom injector (
createEmbeddedView(..., { injector })or*ngTemplateOutlet="...; injector: ..."), theHasEmbeddedViewInjectorflag is set on the view and inherited by descendant component views.When resolving tokens,
lookupTokenUsingEmbeddedInjectorwalks up the view tree without checkingInternalInjectFlags.Host. This allows resolutions with@Host()on directives inside child components within the embedded view to bypass the host component boundary and leak into the custom embedded view injector and its parent injector hierarchy (such as finding an ancestor reactiveFormGroupDirectiveprovidingControlContainer, causing NG01050/NG01350).What is the new behavior?
In
lookupTokenUsingEmbeddedInjector, stop searching parent nodes once the host element node (hostTElementNode = flags & InternalInjectFlags.Host ? lView[DECLARATION_COMPONENT_VIEW][T_HOST] : null) has been checked whenInternalInjectFlags.Hostis set.Does this PR introduce a breaking change?
Other information