fix(browser): escape inline orchestrator scripts

packages/browser/src/node/serverOrchestrator.ts

@@ -61,7 +61,7 @@ export async function resolveOrchestrator(
       for (const attr in script.attrs || {}) {
         html += `${attr}="${script.attrs![attr]}" `
       }
-      html += `>${script.children}</script>`
+      html += `>${escapeInlineScript(typeof script.children === 'string' ? script.children : '')}</script>`
       return html
     }).join('\n')
   }
@@ -96,8 +96,14 @@ export async function resolveOrchestrator(
     __VITEST_FAVICON__: globalServer.faviconUrl,
     __VITEST_TITLE__: 'Vitest Browser Runner',
     __VITEST_SCRIPTS__: globalServer.orchestratorScripts,
-    __VITEST_INJECTOR__: `<script type="module">${injector}</script>`,
+    __VITEST_INJECTOR__: `<script type="module">${escapeInlineScript(injector)}</script>`,
     __VITEST_ERROR_CATCHER__: `<script type="module" src="${globalServer.errorCatcherUrl}"></script>`,
     __VITEST_SESSION_ID__: JSON.stringify(sessionId),
   })
 }
+
+function escapeInlineScript(content: string): string {
+  return content
+    .replace(/<!--/g, '<\\!--')
+    .replace(/<\/(script)/gi, '</\\$1')
+}

test/browser/fixtures/inline-script/basic.test.ts

@@ -0,0 +1,5 @@
+import { expect, inject, test } from 'vitest'
+
+test('provide', () => {
+  expect(inject('someKey' as never)).toBe('</script><h1>inject1</h1><!--')
+})

test/browser/fixtures/inline-script/vite.config.ts

@@ -0,0 +1,26 @@
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { defineConfig } from 'vitest/config'
+import { instances, provider } from '../../settings'
+
+export default defineConfig({
+  cacheDir: path.join(
+    path.dirname(fileURLToPath(import.meta.url)),
+    'node_modules/.vite'
+  ),
+  test: {
+    browser: {
+      enabled: true,
+      provider,
+      instances: [instances[0]],
+      orchestratorScripts: [
+        {
+          content: 'globalThis.__injected = "</script><h1>inject2</h1><!--"',
+        },
+      ],
+    },
+    provide: {
+      someKey: "</script><h1>inject1</h1><!--",
+    },
+  },
+})

test/browser/specs/inline-script.test.ts

@@ -0,0 +1,16 @@
+import { expect, test } from 'vitest'
+import { runBrowserTests } from './utils'
+
+test('escape inline script', async () => {
+  const result = await runBrowserTests({
+    root: './fixtures/inline-script',
+  })
+  expect(result.stderr).toMatchInlineSnapshot(`""`)
+  expect(result.errorTree()).toMatchInlineSnapshot(`
+    {
+      "basic.test.ts": {
+        "provide": "passed",
+      },
+    }
+  `)
+})