@angular/platform-server 20.3.30 → 20.3.32

package/fesm2022/init.mjs

@@ -1,5 +1,5 @@
 /**
- * @license Angular v20.3.30
+ * @license Angular v20.3.32
  * (c) 2010-2025 Google LLC. https://angular.dev/
  * License: MIT
  */
@@ -950,18 +950,41 @@ function requireNodeUtils () {
 
 	const CLOSING_COMMENT_REGEXP = /--!?>/;
 
+	/**
+	 * Escapes a comment content that abruptly closes the comment.
+	 *
+	 * A comment can not carry content that starts with `>` or `->`: the parser
+	 * closes the comment as soon as it comes across such a sequence right after
+	 * `<!--` (the "abrupt-closing-of-empty-comment" parse error). For example,
+	 * `#comment('><img src=x onerror=alert(1)>')` would otherwise serialize into
+	 * `<!--><img src=x onerror=alert(1)>-->`, which de-serializes into an empty
+	 * comment followed by a live `<img>` element. Escaping the leading `>` keeps
+	 * the content inside the comment, where it stays inert.
+	 */
+	function escapeAbruptClosingCommentTag(rawContent) {
+	  if (rawContent.startsWith('>')) {
+	    return '&gt;' + rawContent.slice(1);
+	  }
+	  if (rawContent.startsWith('->')) {
+	    return '-&gt;' + rawContent.slice(2);
+	  }
+	  return rawContent; // fast path
+	}
+
 	/**
 	 * Escapes closing comment tag in a comment content.
 	 *
 	 * For example, given `#comment('-->')`, the content of a comment would be
 	 * updated to `--&gt;` to avoid unexpected and unsafe behavior after
-	 * de-serialization.
+	 * de-serialization. Content that abruptly closes an empty comment is
+	 * escaped as well, see `escapeAbruptClosingCommentTag()`.
 	 */
 	function escapeClosingCommentTag(rawContent) {
-	  if (!CLOSING_COMMENT_REGEXP.test(rawContent)) {
-	    return rawContent; // fast path
+	  const content = escapeAbruptClosingCommentTag(rawContent);
+	  if (!CLOSING_COMMENT_REGEXP.test(content)) {
+	    return content; // fast path
 	  }
-	  return rawContent.replace(/(--\!?)>/g, '$1&gt;');
+	  return content.replace(/(--\!?)>/g, '$1&gt;');
 	}
 
 	/**
@@ -14233,6 +14256,8 @@ function requireHTMLParser () {
 	      emitDoctype();
 	      break;
 	    case -1: // EOF
+	      // Lookahead states must consume the EOF marker explicitly.
+	      nextchar += 1;
 	      forcequirks();
 	      emitDoctype();
 	      emitEOF();