From 1e8c1aa80e714af84af3675ae8c04635b77a7824 Mon Sep 17 00:00:00 2001
From: Lakshmi Tanmay <lakshmi@voltcrash.com>
Date: Wed, 11 Nov 2026 17:54:24 +0530
Subject: [PATCH] fix(shared): keep HTML bootstrap outside quoted attributes

---
 packages/shared/src/htmlRender.test.ts | 16 ++++++++++++++++
 packages/shared/src/htmlRender.ts      |  4 ++--
 2 files changed, 18 insertions(+), 2 deletions(-)

diff --git a/packages/shared/src/htmlRender.test.ts b/packages/shared/src/htmlRender.test.ts
index 793fde8b8246c..db277781d56f6 100644
--- a/packages/shared/src/htmlRender.test.ts
+++ b/packages/shared/src/htmlRender.test.ts
@@ -21,6 +21,22 @@ describe("injectHtmlRenderBootstrap", () => {
     expect(injected).toContain('name="viewport"');
   });
 
+  it.each([
+    "<html><head data-condition='x > 0'>",
+    '<html><head data-condition="x > 0" data-label=\'it "works"\'>',
+    "<html data-condition='x > 0'>",
+    '<html data-condition="x > 0" data-label="it \'works\'">',
+  ])("keeps the bootstrap after the complete opening tag: %s", (opening) => {
+    const prefix = `<!doctype html>${opening}`;
+    const head = opening.startsWith("<html><head") ? "" : "<head>";
+    const content = `${head ? "" : "<title>Report</title></head>"}<body><p>Report</p></body></html>`;
+    const injected = injectHtmlRenderBootstrap(prefix + content);
+    expect(injected.startsWith(`${prefix}${head}<meta charset="utf-8">`)).toBe(true);
+    expect(injected.indexOf('<style id="t3-theme">')).toBeGreaterThan(prefix.length);
+    expect(injected).toContain("<script>");
+    expect(injected.endsWith(content)).toBe(true);
+  });
+
   it("wraps fragments without a head and keeps existing meta tags", () => {
     const fragment =
       '<meta charset="utf-8"><meta name="viewport" content="width=device-width"><p>hi</p>';
diff --git a/packages/shared/src/htmlRender.ts b/packages/shared/src/htmlRender.ts
index 6f42d78f10611..820f94ce01a8c 100644
--- a/packages/shared/src/htmlRender.ts
+++ b/packages/shared/src/htmlRender.ts
@@ -415,12 +415,12 @@ const blankNonMarkup = (html: string) => {
 export function injectHtmlRenderBootstrap(html: string): string {
   const scan = blankNonMarkup(html);
   const markup = bootstrapMarkup(scan);
-  const headOpen = /<head(?:\s[^>]*)?>/i.exec(scan);
+  const headOpen = /<head(?:\s(?:[^"'>]|"[^"]*"|'[^']*')*)?>/i.exec(scan);
   if (headOpen) {
     const at = headOpen.index + headOpen[0].length;
     return html.slice(0, at) + markup + html.slice(at);
   }
-  const htmlOpen = /<html(?:\s[^>]*)?>/i.exec(scan);
+  const htmlOpen = /<html(?:\s(?:[^"'>]|"[^"]*"|'[^']*')*)?>/i.exec(scan);
   if (htmlOpen) {
     const at = htmlOpen.index + htmlOpen[0].length;
     return `${html.slice(0, at)}<head>${markup}</head>${html.slice(at)}`;