@angular/platform-server 22.2.0-next.4 → 22.2.0-next.5

package/third_party/domino/bundled-domino.mjs

@@ -944,18 +944,41 @@ function requireNodeUtils () {
 
 	const CLOSING_COMMENT_REGEXP = /--!?>/;
 
+	/**
+	 * Escapes a comment content that abruptly closes the comment.
+	 *
+	 * A comment can not carry content that starts with `>` or `->`: the parser
+	 * closes the comment as soon as it comes across such a sequence right after
+	 * `<!--` (the "abrupt-closing-of-empty-comment" parse error). For example,
+	 * `#comment('><img src=x onerror=alert(1)>')` would otherwise serialize into
+	 * `<!--><img src=x onerror=alert(1)>-->`, which de-serializes into an empty
+	 * comment followed by a live `<img>` element. Escaping the leading `>` keeps
+	 * the content inside the comment, where it stays inert.
+	 */
+	function escapeAbruptClosingCommentTag(rawContent) {
+	  if (rawContent.startsWith('>')) {
+	    return '&gt;' + rawContent.slice(1);
+	  }
+	  if (rawContent.startsWith('->')) {
+	    return '-&gt;' + rawContent.slice(2);
+	  }
+	  return rawContent; // fast path
+	}
+
 	/**
 	 * Escapes closing comment tag in a comment content.
 	 *
 	 * For example, given `#comment('-->')`, the content of a comment would be
 	 * updated to `--&gt;` to avoid unexpected and unsafe behavior after
-	 * de-serialization.
+	 * de-serialization. Content that abruptly closes an empty comment is
+	 * escaped as well, see `escapeAbruptClosingCommentTag()`.
 	 */
 	function escapeClosingCommentTag(rawContent) {
-	  if (!CLOSING_COMMENT_REGEXP.test(rawContent)) {
-	    return rawContent; // fast path
+	  const content = escapeAbruptClosingCommentTag(rawContent);
+	  if (!CLOSING_COMMENT_REGEXP.test(content)) {
+	    return content; // fast path
 	  }
-	  return rawContent.replace(/(--\!?)>/g, '$1&gt;');
+	  return content.replace(/(--\!?)>/g, '$1&gt;');
 	}
 
 	/**