From 3d370c40640ea1b5546d01997e3676a49984c489 Mon Sep 17 00:00:00 2001
From: James <james.russo@heygen.com>
Date: Wed, 6 May 2026 05:06:42 +0000
Subject: [PATCH] test(bundler): parse scripts via linkedom, not regex
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Per CodeQL's `js/bad-tag-filter` recommendation, replace the regex-based
`<script>` body extraction with a `parseHTML` + `querySelectorAll`
walk. The rule explicitly says "use a parser library" — and linkedom
is already imported in this file, so the diff is small.

This eliminates the regex entirely, so the rule can no longer fire on
this site (instead of chasing whitespace / case / trailing-content
edge cases one at a time).
---
 packages/core/src/compiler/htmlBundler.test.ts | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/packages/core/src/compiler/htmlBundler.test.ts b/packages/core/src/compiler/htmlBundler.test.ts
index c70f49037..665ff9811 100644
--- a/packages/core/src/compiler/htmlBundler.test.ts
+++ b/packages/core/src/compiler/htmlBundler.test.ts
@@ -105,12 +105,12 @@ describe("bundleToSingleHtml", () => {
     const bundled = await bundleToSingleHtml(dir);
     // Run every inline script body through esbuild; if the line comment ate
     // the separator, parse would fail with an unexpected-token error somewhere
-    // around the chunk boundary.
+    // around the chunk boundary. Use a real HTML parser (CodeQL flags regex-
+    // based script extraction as bad-tag-filter).
     const { transformSync } = await import("esbuild");
-    const re = /<script\b[^>]*>([\s\S]*?)<\/script[^>]*>/gi;
-    let m: RegExpExecArray | null;
-    while ((m = re.exec(bundled)) !== null) {
-      const body = m[1];
+    const { document } = parseHTML(bundled);
+    for (const script of document.querySelectorAll("script")) {
+      const body = script.textContent;
       if (!body || !body.trim()) continue;
       expect(() => transformSync(body, { loader: "js", minify: false })).not.toThrow();
     }