unescaped script tags strings in injected code

[hville]

🐛 bug report

Inline code injection into html pages can insert unescaped html tags (first mentioned in #6213) .
Javascript strings containing html code need to be escaped before html injection

💻 Code Sample AND Current Behavior

//source module.js
export const tag = `<script></script>`

//source index.html
<script type=module>import {tag} from './module.js'</script>

//served bundled index.html
<script type=module>const tag = `<script></script>`</script>

🎛 Configuration (.babelrc, package.json, cli command)

no configuration file used

🌍 Your Environment

Software	Version(s)
Parcel	2.0.0-beta.2
Node	v15.8.0

[mischnic]

The replacement happens here:

parcel/packages/packagers/html/src/HTMLPackager.js

Lines 127 to 138 in a67a5f0

	let newContent = await getAssetContent(
	bundleGraph,
	getInlineBundleContents,
	node.attrs['data-parcel-key'],
	);
	if (newContent != null) {
	let {contents, bundle} = newContent;
	node.content = (contents instanceof Readable
	? await bufferStream(contents)
	: contents
	).toString();

We "just" need to escape </ in that string. (Though I'm not sure yet how)

[devongovett]

This was the best answer I found: https://stackoverflow.com/a/23983448. Basically replace '</script' with '</scr\ipt'.