[READ-ONLY] Mirror of https://github.com/vitest-dev/vitest. Next generation testing framework powered by Vite.
vitest.dev
test
testing-tools
vite
fix(browser): escape inline orchestrator scripts (#10412)
Co-authored-by: Codex <noreply@openai.com>
authored by
Hiroshi Ogawa
Codex
and committed by
GitHub
(May 21, 2026, 9:17 AM +0200)
c22cfb65
9bd17f47
+55
-2
+16
test/browser/specs/inline-script.test.ts
+16
test/browser/specs/inline-script.test.ts
···
1
+
import { expect, test } from 'vitest'
2
+
import { runBrowserTests } from './utils'
3
+
4
+
test('escape inline script', async () => {
5
+
const result = await runBrowserTests({
6
+
root: './fixtures/inline-script',
7
+
})
8
+
expect(result.stderr).toMatchInlineSnapshot(`""`)
9
+
expect(result.errorTree()).toMatchInlineSnapshot(`
10
+
{
11
+
"basic.test.ts": {
12
+
"provide": "passed",
13
+
},
14
+
}
15
+
`)
16
+
})
+8
-2
packages/browser/src/node/serverOrchestrator.ts
+8
-2
packages/browser/src/node/serverOrchestrator.ts
···
61
61
for (const attr in script.attrs || {}) {
62
62
html += `${attr}="${script.attrs![attr]}" `
63
63
}
64
-
html += `>${script.children}</script>`
64
+
html += `>${escapeInlineScript(typeof script.children === 'string' ? script.children : '')}</script>`
65
65
return html
66
66
}).join('\n')
67
67
}
···
96
96
__VITEST_FAVICON__: globalServer.faviconUrl,
97
97
__VITEST_TITLE__: 'Vitest Browser Runner',
98
98
__VITEST_SCRIPTS__: globalServer.orchestratorScripts,
99
-
__VITEST_INJECTOR__: `<script type="module">${injector}</script>`,
99
+
__VITEST_INJECTOR__: `<script type="module">${escapeInlineScript(injector)}</script>`,
100
100
__VITEST_ERROR_CATCHER__: `<script type="module" src="${globalServer.errorCatcherUrl}"></script>`,
101
101
__VITEST_SESSION_ID__: JSON.stringify(sessionId),
102
102
})
103
+
}
104
+
105
+
function escapeInlineScript(content: string): string {
106
+
return content
107
+
.replace(/<!--/g, '<\\!--')
108
+
.replace(/<\/(script)/gi, '</\\$1')
103
109
}
+5
test/browser/fixtures/inline-script/basic.test.ts
+5
test/browser/fixtures/inline-script/basic.test.ts
+26
test/browser/fixtures/inline-script/vite.config.ts
+26
test/browser/fixtures/inline-script/vite.config.ts
···
1
+
import path from 'node:path'
2
+
import { fileURLToPath } from 'node:url'
3
+
import { defineConfig } from 'vitest/config'
4
+
import { instances, provider } from '../../settings'
5
+
6
+
export default defineConfig({
7
+
cacheDir: path.join(
8
+
path.dirname(fileURLToPath(import.meta.url)),
9
+
'node_modules/.vite'
10
+
),
11
+
test: {
12
+
browser: {
13
+
enabled: true,
14
+
provider,
15
+
instances: [instances[0]],
16
+
orchestratorScripts: [
17
+
{
18
+
content: 'globalThis.__injected = "</script><h1>inject2</h1><!--"',
19
+
},
20
+
],
21
+
},
22
+
provide: {
23
+
someKey: "</script><h1>inject1</h1><!--",
24
+
},
25
+
},
26
+
})