@angular/platform-server 21.2.21 → 21.2.23

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@angular/platform-server",
-  "version": "21.2.21",
+  "version": "21.2.23",
   "description": "Angular - library for using Angular in Node.js",
   "author": "angular",
   "license": "MIT",
@@ -8,10 +8,10 @@
     "node": "^20.19.0 || ^22.12.0 || >=24.0.0"
   },
   "peerDependencies": {
-    "@angular/common": "21.2.21",
-    "@angular/compiler": "21.2.21",
-    "@angular/core": "21.2.21",
-    "@angular/platform-browser": "21.2.21",
+    "@angular/common": "21.2.23",
+    "@angular/compiler": "21.2.23",
+    "@angular/core": "21.2.23",
+    "@angular/platform-browser": "21.2.23",
     "rxjs": "^6.5.3 || ^7.4.0"
   },
   "dependencies": {

package/third_party/domino/bundled-domino.mjs

@@ -848,6 +848,23 @@ function requireNodeUtils () {
 	  return a.name;
 	}
 
+	function fallbackRawContentTags(node) {
+	  const tags = [];
+	  while (node) {
+	    if (node.nodeType === 1 /*ELEMENT_NODE*/) {
+	      if (node.namespaceURI === NAMESPACE.HTML && hasRawContentFallback[node.tagName]) {
+	        tags.push(node.localName);
+	      }
+	      node = node.parentNode;
+	    } else if (node.nodeType === 11 /*DOCUMENT_FRAGMENT_NODE*/ && node._host) {
+	      node = node._host;
+	    } else {
+	      node = node.parentNode;
+	    }
+	  }
+	  return tags;
+	}
+
 	/**
 	 * Escapes matching closing tag in a raw text.
 	 *
@@ -877,12 +894,22 @@ function requireNodeUtils () {
 	  return text.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
 	}
 
-	function escapeFallbackRawText(rawText, parentTag) {
-	  var result = '';
-	  var index = 0;
+	function escapeMatchingClosingTags(rawText, parentTag, ancestorTags) {
+	  let result = escapeMatchingClosingTag(rawText, parentTag);
+	  if (ancestorTags) {
+	    for (const ancestorTag of ancestorTags) {
+	      result = escapeMatchingClosingTag(result, ancestorTag);
+	    }
+	  }
+	  return result;
+	}
+
+	function escapeFallbackRawText(rawText, parentTag, ancestorTags) {
+	  let result = '';
+	  let index = 0;
 
 	  while (index < rawText.length) {
-	    var commentStart = rawText.indexOf('<!--', index);
+	    const commentStart = rawText.indexOf('<!--', index);
 	    if (commentStart === -1) {
 	      result += escape(rawText.slice(index));
 	      break;
@@ -890,15 +917,15 @@ function requireNodeUtils () {
 
 	    result += escape(rawText.slice(index, commentStart));
 
-	    var commentEnd = findCommentEnd(rawText, commentStart + 4);
+	    const commentEnd = findCommentEnd(rawText, commentStart + 4);
 	    if (commentEnd === -1) {
-	      result += escapeMatchingClosingTag(rawText.slice(commentStart), parentTag);
+	      result += escapeMatchingClosingTags(rawText.slice(commentStart), parentTag, ancestorTags);
 	      break;
 	    }
 
 	    // A complete HTML comment remains inert if downstream tooling reparses
 	    // fallback raw text as normal HTML, so preserve its comment semantics.
-	    result += escapeMatchingClosingTag(rawText.slice(commentStart, commentEnd), parentTag);
+	    result += escapeMatchingClosingTags(rawText.slice(commentStart, commentEnd), parentTag, ancestorTags);
 	    index = commentEnd;
 	  }
 
@@ -911,24 +938,47 @@ function requireNodeUtils () {
 	  if (rawText.charAt(index) === '-' && rawText.charAt(index + 1) === '>')
 	    return index + 2;
 
-	  var match = CLOSING_COMMENT_REGEXP.exec(rawText.slice(index));
+	  const match = CLOSING_COMMENT_REGEXP.exec(rawText.slice(index));
 	  return match ? index + match.index + match[0].length : -1;
 	}
 
 	const CLOSING_COMMENT_REGEXP = /--!?>/;
 
+	/**
+	 * Escapes a comment content that abruptly closes the comment.
+	 *
+	 * A comment can not carry content that starts with `>` or `->`: the parser
+	 * closes the comment as soon as it comes across such a sequence right after
+	 * `<!--` (the "abrupt-closing-of-empty-comment" parse error). For example,
+	 * `#comment('><img src=x onerror=alert(1)>')` would otherwise serialize into
+	 * `<!--><img src=x onerror=alert(1)>-->`, which de-serializes into an empty
+	 * comment followed by a live `<img>` element. Escaping the leading `>` keeps
+	 * the content inside the comment, where it stays inert.
+	 */
+	function escapeAbruptClosingCommentTag(rawContent) {
+	  if (rawContent.startsWith('>')) {
+	    return '&gt;' + rawContent.slice(1);
+	  }
+	  if (rawContent.startsWith('->')) {
+	    return '-&gt;' + rawContent.slice(2);
+	  }
+	  return rawContent; // fast path
+	}
+
 	/**
 	 * Escapes closing comment tag in a comment content.
 	 *
 	 * For example, given `#comment('-->')`, the content of a comment would be
 	 * updated to `--&gt;` to avoid unexpected and unsafe behavior after
-	 * de-serialization.
+	 * de-serialization. Content that abruptly closes an empty comment is
+	 * escaped as well, see `escapeAbruptClosingCommentTag()`.
 	 */
 	function escapeClosingCommentTag(rawContent) {
-	  if (!CLOSING_COMMENT_REGEXP.test(rawContent)) {
-	    return rawContent; // fast path
+	  const content = escapeAbruptClosingCommentTag(rawContent);
+	  if (!CLOSING_COMMENT_REGEXP.test(content)) {
+	    return content; // fast path
 	  }
-	  return rawContent.replace(/(--\!?)>/g, '$1&gt;');
+	  return content.replace(/(--\!?)>/g, '$1&gt;');
 	}
 
 	/**
@@ -962,8 +1012,12 @@ function requireNodeUtils () {
 	        // If an element can have raw content, this content may
 	        // potentially require escaping to avoid XSS.
 	        var upperTag = tagname.toUpperCase();
-	        if (hasRawContent[upperTag] && !hasRawContentFallback[upperTag]) {
+	        if (hasRawContent[upperTag] && !hasRawContentFallback[upperTag] && ss.includes('</')) {
 	          ss = escapeMatchingClosingTag(ss, tagname);
+	          const fallbackTags = fallbackRawContentTags(parent);
+	          for (const fallbackTag of fallbackTags) {
+	            ss = escapeMatchingClosingTag(ss, fallbackTag);
+	          }
 	        }
 	        if (html && extraNewLine[tagname] && ss.charAt(0)==='\n') s += '\n';
 	        // Serialize children and add end tag for all others
@@ -983,22 +1037,33 @@ function requireNodeUtils () {
 	      if (hasRawContent[parenttag]) {
 	        // Preserve actual child element markup in fallback elements such as
 	        // <noscript>, but do not emit text-node payloads as raw HTML.
-	        s += hasRawContentFallback[parenttag] ? escapeFallbackRawText(kid.data, parent.localName) : kid.data;
+	        s += hasRawContentFallback[parenttag] ? escapeFallbackRawText(kid.data, parent.localName, fallbackRawContentTags(parent.parentNode)) : kid.data;
 	      } else {
 	        s += escape(kid.data);
 	      }
 	      break;
 	    case 8: //COMMENT_NODE
-	      s += '<!--' + escapeClosingCommentTag(kid.data) + '-->';
+	      let commentData = escapeClosingCommentTag(kid.data);
+	      if (commentData.includes('</')) {
+	        const fallbackTags = fallbackRawContentTags(parent);
+	        for (const fallbackTag of fallbackTags) {
+	          commentData = escapeMatchingClosingTag(commentData, fallbackTag);
+	        }
+	      }
+	      s += '<!--' + commentData + '-->';
 	      break;
 	    case 7: //PROCESSING_INSTRUCTION_NODE
-	      const content = escapeProcessingInstructionContent(kid.data);
+	      let content = escapeProcessingInstructionContent(kid.data);
+	      if (content.includes('</')) {
+	        const fallbackTags = fallbackRawContentTags(parent);
+	        for (const fallbackTag of fallbackTags) {
+	          content = escapeMatchingClosingTag(content, fallbackTag);
+	        }
+	      }
 	      s += '<?' + kid.target + ' ' + content + '?>';
 	      break;
 	    case 10: //DOCUMENT_TYPE_NODE
-	      s += '<!DOCTYPE ' + kid.name;
-
-	      s += '>';
+	      s += '<!DOCTYPE ' + kid.name + '>';
 	      break;
 	    default:
 	      utils.InvalidStateError();
@@ -7588,7 +7653,7 @@ function requireHtmlelts () {
 	    required: Boolean,
 	    readOnly: Boolean,
 	    checked: Boolean,
-	    value: String,
+	    value: { type: String, treatNullAsEmptyString: true },
 	    src: URL,
 	    defaultChecked: {name: 'checked', type: Boolean},
 	    size: {type: 'unsigned long', default: 20, min: 1, setmin: 1},
@@ -8111,10 +8176,21 @@ function requireHtmlelts () {
 	  ctor: function HTMLTemplateElement(doc, localName, prefix) {
 	    HTMLElement.call(this, doc, localName, prefix);
 	    this._contentFragment = doc._templateDoc.createDocumentFragment();
+	    this._contentFragment._host = this;
 	  },
 	  props: {
 	    content: { get: function() { return this._contentFragment; } },
-	    serialize: { value: function() { return this.content.serialize(); } }
+	    serialize: { value: function() { return this.content.serialize(); } },
+	    cloneNode: {
+	      value: function(deep) {
+	        var clone = HTMLElement.prototype.cloneNode.call(this, deep);
+	        if (deep) {
+	          clone._contentFragment = this._contentFragment.cloneNode(true);
+	          clone._contentFragment._host = clone;
+	        }
+	        return clone;
+	      }
+	    }
 	  }
 	});
 
@@ -14182,6 +14258,8 @@ function requireHTMLParser () {
 	      emitDoctype();
 	      break;
 	    case -1: // EOF
+	      // Lookahead states must consume the EOF marker explicitly.
+	      nextchar += 1;
 	      forcequirks();
 	      emitDoctype();
 	      emitEOF();