From d58d23e2f7ae2c485ad3cd6f0f924864227347c9 Mon Sep 17 00:00:00 2001
From: Brian Whitton <bwhitton@gmail.com>
Date: Fri, 8 Oct 2021 09:01:51 -0400
Subject: [PATCH] fix: escape closing script tag

if a svelte app is inlined to a browser (i.e. stuffed in between `<script>...</script>` tags instead of loaded remotely), this tag is parsed as a valid closing script tag.
---
 src/runtime/internal/dom.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/runtime/internal/dom.ts b/src/runtime/internal/dom.ts
index eb3389e3f8..059e069924 100644
--- a/src/runtime/internal/dom.ts
+++ b/src/runtime/internal/dom.ts
@@ -602,7 +602,7 @@ export function add_resize_listener(node: HTMLElement, fn: () => void) {
 	let unsubscribe: () => void;
 
 	if (crossorigin) {
-		iframe.src = "data:text/html,<script>onresize=function(){parent.postMessage(0,'*')}</script>";
+		iframe.src = "data:text/html,<script>onresize=function(){parent.postMessage(0,'*')}<\/script>";
 		unsubscribe = listen(window, 'message', (event: MessageEvent) => {
 			if (event.source === iframe.contentWindow) fn();
 		});