fix(unhead): end extracted script and style at the first closing tag - #1028

🔗 Linked issue

None.

❓ Type of change

• 📖 Documentation (updates to the documentation or readme)
• 🐞 Bug fix (a non-breaking change that fixes an issue)
• 👌 Enhancement (improving an existing functionality)
• ✨ New feature (a non-breaking change that adds functionality)
• 🧹 Chore (updates to the build process or auxiliary tools and libraries)
• ⚠️ Breaking change (fix or feature that would cause existing functionality to change)

📚 Description

findClosingTag tracks JS quote state inside <script> and <style>, so an apostrophe in a comment (// don't ..., /* it's */) or a regex like /"/g hides the real closing tag. transformHtmlTemplate then drops the element and leaves its source as text in <head>: <script>// don't flash</script> becomes // don't flash</script>. With quotes balanced across tags, <script>// it's</script><script src="/a.js"></script><script>// it's</script> is merged into one inline script and the src script is lost.

Script, style and title content now ends at the first closing tag, as in browsers (the regex parser used before #581 also stopped at the first lowercase closing tag). As in the HTML tokenizer, the tag name matches in any letter case and ends at whitespace, a form feed, / or >, so </SCRIPT> and </style/> close their element and </titles> does not. The template in the "potential XSS in script content extraction" test is now split the same way a browser splits that source. Inside a script, <!-- <script> keeps the next </script> as script text unless --> comes first, as browsers do, with the same name matching (<!-- <SCRIPT> and <!-- <script/> count, <!-- <scripts> does not), so legacy <!-- document.write('<script>..</script>') --> blocks stay whole whether or not they are quoted.

• Ran: vitest run in packages/unhead, 1369 passed, 8 skipped. The tests for each change fail before it; the <!-- <scripts> case is a guard and passes either way.
• Checked: extracted scripts, styles and titles match jsdom for 39 edge cases, including the ones above and the XSS template; eslint and tsc are clean on the touched files, and unbuild succeeds.

Summary by CodeRabbit

• Bug Fixes
  • Improved HTML parsing to recognize complete closing tags regardless of letter case, while correctly handling script content that contains comments, escaped text, or tag-like strings.
  • Corrected script and style parsing so quotes and backslashes in content do not incorrectly prevent closing tags from being detected.
  • Preserved distinct parsing of adjacent script elements and avoided treating tag names after comment markers as nested scripts.