fix(compiler): don't inject viewProviders
into content child elements
E.g. in the following scenario, `some-directive` should not be able to inject any view provider that `my-comp-with-view-providers` declares. ``` <my-comp-with-view-providers> <div some-directive></div> </my-comp-with-view-providers> ```
This commit is contained in:
@ -313,6 +313,14 @@ export class CompileElement extends CompileNode {
|
||||
}
|
||||
// access regular providers on the element
|
||||
if (isBlank(result)) {
|
||||
let resolvedProvider = this._resolvedProviders.get(dep.token);
|
||||
// don't allow directives / public services to access private services.
|
||||
// only components and private services can access private services.
|
||||
if (resolvedProvider && (requestingProviderType === ProviderAstType.Directive ||
|
||||
requestingProviderType === ProviderAstType.PublicService) &&
|
||||
resolvedProvider.providerType === ProviderAstType.PrivateService) {
|
||||
return null;
|
||||
}
|
||||
result = this._instances.get(dep.token);
|
||||
}
|
||||
}
|
||||
|
Reference in New Issue
Block a user