fix(view): prevent infinite loop with unclosed PHP or comment tags (#1282)

Author: brendt

packages/view/src/Parser/TempestViewLexer.php

@@ -10,6 +10,8 @@ final class TempestViewLexer
 
     private ?string $current;
 
+    private bool $eof = false;
+
     public function __construct(
         private readonly string $html,
     ) {
@@ -155,7 +157,7 @@ private function lexPhp(): Token
     {
         $buffer = '';
 
-        while ($this->seek(2) !== '?>') {
+        while ($this->seek(2) !== '?>' && $this->current) {
             $buffer .= $this->consume();
         }
 
@@ -175,7 +177,7 @@ private function lexComment(): Token
     {
         $buffer = '';
 
-        while ($this->seek(3) !== '-->') {
+        while ($this->seek(3) !== '-->' && $this->current) {
             $buffer .= $this->consume();
         }
 

packages/view/tests/TempestViewLexerTest.php

@@ -220,6 +220,24 @@ public function test_attribute_with_new_line(): void
         ], $tokens);
     }
 
+    public function test_unclosed_php_tag(): void
+    {
+        $tokens = new TempestViewLexer('<?php echo "hi";')->lex();
+
+        $this->assertTokens([
+            new Token('<?php echo "hi";', TokenType::PHP),
+        ], $tokens);
+    }
+
+    public function test_unclosed_comment_tag(): void
+    {
+        $tokens = new TempestViewLexer('<!-- comment')->lex();
+
+        $this->assertTokens([
+            new Token('<!-- comment', TokenType::COMMENT),
+        ], $tokens);
+    }
+
     private function assertTokens(array $expected, TokenCollection $actual): void
     {
         $this->assertCount(count($expected), $actual);

tests/Integration/View/TempestViewRendererTest.php

@@ -709,4 +709,13 @@ public function test_escape_expression_attribute(): void
 
         $this->assertSnippetsMatch('<div :escaped="foo"></div>', $html);
     }
+
+    public function test_unclosed_php_tag(): void
+    {
+        $html = $this->render(<<<'HTML'
+        <?php echo 'hi';
+        HTML);
+
+        $this->assertSame('hi', $html);
+    }
 }