fix(core): escape comment markers which share characters

escapeCommentText matched each disallowed marker as a whole, so a marker that overlaps an already matched one was skipped by the scanner and left unescaped. Match the delimiter together with its context instead, which keeps the matched language identical for the existing cases.

Author: arshsmith1

packages/core/src/util/dom.ts

@@ -7,11 +7,16 @@
  */
 
 /**
- * Disallowed strings in the comment.
+ * Matches the `<` or `>` of a disallowed string in the comment.
+ *
+ * The delimiter is matched together with the surrounding context rather than the disallowed string
+ * as a whole, so that disallowed strings sharing characters (such as the `--` of `<!--` and `--!>`
+ * in `<!--!>`) are all escaped. A pattern matching the whole string would consume the shared
+ * characters with the first match and never see the second one.
  *
  * see: https://html.spec.whatwg.org/multipage/syntax.html#comments
  */
-const COMMENT_DISALLOWED = /^>|^->|<!--|-->|--!>|<!-$/g;
+const COMMENT_DISALLOWED = /(^-?|--!?)>|<(?=!--|!-$)/g;
 /**
  * Delimiter in the disallowed strings which needs to be wrapped with zero with character.
  */

packages/core/test/util/dom_spec.ts

@@ -45,5 +45,14 @@ describe('comment node text escaping', () => {
       expect(escapeCommentText('.->')).toEqual('.->');
       expect(escapeCommentText('<!-.')).toEqual('<!-.');
     });
+
+    it('should escape markers which share characters', () => {
+      // The `--` belongs to both the `<!--` and the `--!>`/`-->` marker.
+      expect(escapeCommentText('<!--!>')).toEqual('\u200b<\u200b!--!\u200b>\u200b');
+      expect(escapeCommentText('<!--->')).toEqual('\u200b<\u200b!---\u200b>\u200b');
+      expect(escapeCommentText('<!--!><img src="x">')).toEqual(
+        '\u200b<\u200b!--!\u200b>\u200b<img src="x">',
+      );
+    });
   });
 });