@angular/platform-server 22.2.0-next.3 → 22.2.0-next.5

package/third_party/domino/bundled-domino.mjs

@@ -850,11 +850,17 @@ function requireNodeUtils () {
 
 	function fallbackRawContentTags(node) {
 	  const tags = [];
-	  while (node?.nodeType === 1 /*ELEMENT_NODE*/) {
-	    if (node.namespaceURI === NAMESPACE.HTML && hasRawContentFallback[node.tagName]) {
-	      tags.push(node.localName);
+	  while (node) {
+	    if (node.nodeType === 1 /*ELEMENT_NODE*/) {
+	      if (node.namespaceURI === NAMESPACE.HTML && hasRawContentFallback[node.tagName]) {
+	        tags.push(node.localName);
+	      }
+	      node = node.parentNode;
+	    } else if (node.nodeType === 11 /*DOCUMENT_FRAGMENT_NODE*/ && node._host) {
+	      node = node._host;
+	    } else {
+	      node = node.parentNode;
 	    }
-	    node = node.parentNode;
 	  }
 	  return tags;
 	}
@@ -938,18 +944,41 @@ function requireNodeUtils () {
 
 	const CLOSING_COMMENT_REGEXP = /--!?>/;
 
+	/**
+	 * Escapes a comment content that abruptly closes the comment.
+	 *
+	 * A comment can not carry content that starts with `>` or `->`: the parser
+	 * closes the comment as soon as it comes across such a sequence right after
+	 * `<!--` (the "abrupt-closing-of-empty-comment" parse error). For example,
+	 * `#comment('><img src=x onerror=alert(1)>')` would otherwise serialize into
+	 * `<!--><img src=x onerror=alert(1)>-->`, which de-serializes into an empty
+	 * comment followed by a live `<img>` element. Escaping the leading `>` keeps
+	 * the content inside the comment, where it stays inert.
+	 */
+	function escapeAbruptClosingCommentTag(rawContent) {
+	  if (rawContent.startsWith('>')) {
+	    return '&gt;' + rawContent.slice(1);
+	  }
+	  if (rawContent.startsWith('->')) {
+	    return '-&gt;' + rawContent.slice(2);
+	  }
+	  return rawContent; // fast path
+	}
+
 	/**
 	 * Escapes closing comment tag in a comment content.
 	 *
 	 * For example, given `#comment('-->')`, the content of a comment would be
 	 * updated to `--&gt;` to avoid unexpected and unsafe behavior after
-	 * de-serialization.
+	 * de-serialization. Content that abruptly closes an empty comment is
+	 * escaped as well, see `escapeAbruptClosingCommentTag()`.
 	 */
 	function escapeClosingCommentTag(rawContent) {
-	  if (!CLOSING_COMMENT_REGEXP.test(rawContent)) {
-	    return rawContent; // fast path
+	  const content = escapeAbruptClosingCommentTag(rawContent);
+	  if (!CLOSING_COMMENT_REGEXP.test(content)) {
+	    return content; // fast path
 	  }
-	  return rawContent.replace(/(--\!?)>/g, '$1&gt;');
+	  return content.replace(/(--\!?)>/g, '$1&gt;');
 	}
 
 	/**
@@ -1024,7 +1053,13 @@ function requireNodeUtils () {
 	      s += '<!--' + commentData + '-->';
 	      break;
 	    case 7: //PROCESSING_INSTRUCTION_NODE
-	      const content = escapeProcessingInstructionContent(kid.data);
+	      let content = escapeProcessingInstructionContent(kid.data);
+	      if (content.includes('</')) {
+	        const fallbackTags = fallbackRawContentTags(parent);
+	        for (const fallbackTag of fallbackTags) {
+	          content = escapeMatchingClosingTag(content, fallbackTag);
+	        }
+	      }
 	      s += '<?' + kid.target + ' ' + content + '?>';
 	      break;
 	    case 10: //DOCUMENT_TYPE_NODE
@@ -8141,10 +8176,21 @@ function requireHtmlelts () {
 	  ctor: function HTMLTemplateElement(doc, localName, prefix) {
 	    HTMLElement.call(this, doc, localName, prefix);
 	    this._contentFragment = doc._templateDoc.createDocumentFragment();
+	    this._contentFragment._host = this;
 	  },
 	  props: {
 	    content: { get: function() { return this._contentFragment; } },
-	    serialize: { value: function() { return this.content.serialize(); } }
+	    serialize: { value: function() { return this.content.serialize(); } },
+	    cloneNode: {
+	      value: function(deep) {
+	        var clone = HTMLElement.prototype.cloneNode.call(this, deep);
+	        if (deep) {
+	          clone._contentFragment = this._contentFragment.cloneNode(true);
+	          clone._contentFragment._host = clone;
+	        }
+	        return clone;
+	      }
+	    }
 	  }
 	});