From 9ed8f2d26e2e838554e23aa9de3eabbd6cf275cb Mon Sep 17 00:00:00 2001
From: Tobias Bosch <tbosch1009@gmail.com>
Date: Thu, 23 Jun 2016 09:59:45 -0700
Subject: [PATCH] fix(compiler): don't inject `viewProviders` into content
 child elements

E.g. in the following scenario,
`some-directive` should not be able to inject
any view provider that `my-comp-with-view-providers`
declares.

```
<my-comp-with-view-providers>
  <div some-directive></div>
</my-comp-with-view-providers>
```
---
 .../compiler/src/view_compiler/compile_element.ts    |  8 ++++++++
 .../test/linker/view_injector_integration_spec.ts    | 12 +++++++++++-
 2 files changed, 19 insertions(+), 1 deletion(-)

diff --git a/modules/@angular/compiler/src/view_compiler/compile_element.ts b/modules/@angular/compiler/src/view_compiler/compile_element.ts
index c7318806df..d43022e269 100644
--- a/modules/@angular/compiler/src/view_compiler/compile_element.ts
+++ b/modules/@angular/compiler/src/view_compiler/compile_element.ts
@@ -313,6 +313,14 @@ export class CompileElement extends CompileNode {
       }
       // access regular providers on the element
       if (isBlank(result)) {
+        let resolvedProvider = this._resolvedProviders.get(dep.token);
+        // don't allow directives / public services to access private services.
+        // only components and private services can access private services.
+        if (resolvedProvider && (requestingProviderType === ProviderAstType.Directive ||
+                                 requestingProviderType === ProviderAstType.PublicService) &&
+            resolvedProvider.providerType === ProviderAstType.PrivateService) {
+          return null;
+        }
         result = this._instances.get(dep.token);
       }
     }
diff --git a/modules/@angular/core/test/linker/view_injector_integration_spec.ts b/modules/@angular/core/test/linker/view_injector_integration_spec.ts
index 9236c39fee..804fdcf920 100644
--- a/modules/@angular/core/test/linker/view_injector_integration_spec.ts
+++ b/modules/@angular/core/test/linker/view_injector_integration_spec.ts
@@ -397,7 +397,7 @@ export function main() {
            expect(created).toBe(true);
          }));
 
-      it('should not instantiate other directives that depend on viewProviders providers',
+      it('should not instantiate other directives that depend on viewProviders providers (same element)',
          fakeAsync(() => {
            expect(
                () => createComp(
@@ -407,6 +407,16 @@ export function main() {
                .toThrowError(/No provider for service!/);
          }));
 
+      it('should not instantiate other directives that depend on viewProviders providers (child element)',
+         fakeAsync(() => {
+           expect(
+               () => createComp(
+                   '<div simpleComponent><div needsService></div></div>',
+                   tcb.overrideViewProviders(
+                       SimpleComponent, [{provide: 'service', useValue: 'service'}])))
+               .toThrowError(/No provider for service!/);
+         }));
+
       it('should instantiate directives that depend on providers of other directives',
          fakeAsync(() => {
            var el = createComp(