From b075f90b789b8e84df8f8f7d8efd995583678fb3 Mon Sep 17 00:00:00 2001
From: James <james.russo@heygen.com>
Date: Wed, 6 May 2026 04:59:41 +0000
Subject: [PATCH] test(bundler): tolerate whitespace in closing script tag
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

CodeQL's `js/bad-tag-filter` rule flagged `</script>` as too strict —
`</script >` (with whitespace before `>`) is valid HTML and would slip
past the matcher. Changed to `</script\s*>` for full defense-in-depth.

The bundler always emits the canonical form, so no real-traffic miss —
this is hardening the test's parse-loop, not fixing a downstream bug.

Addresses CodeQL alert on #641.
---
 packages/core/src/compiler/htmlBundler.test.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/packages/core/src/compiler/htmlBundler.test.ts b/packages/core/src/compiler/htmlBundler.test.ts
index aa2ccbc7b..7675b307f 100644
--- a/packages/core/src/compiler/htmlBundler.test.ts
+++ b/packages/core/src/compiler/htmlBundler.test.ts
@@ -107,7 +107,7 @@ describe("bundleToSingleHtml", () => {
     // the separator, parse would fail with an unexpected-token error somewhere
     // around the chunk boundary.
     const { transformSync } = await import("esbuild");
-    const re = /<script\b[^>]*>([\s\S]*?)<\/script>/gi;
+    const re = /<script\b[^>]*>([\s\S]*?)<\/script\s*>/gi;
     let m: RegExpExecArray | null;
     while ((m = re.exec(bundled)) !== null) {
       const body = m[1];