fix: disallow `--` in `idPrefix` (#18038)

supersedes #17993

.changeset/evil-chicken-attend.md

@@ -0,0 +1,5 @@
+---
+'svelte': patch
+---
+
+fix: disallow `--` in `idPrefix`

documentation/docs/98-reference/.generated/server-errors.md

@@ -69,6 +69,12 @@ Cause:
 `csp.nonce` was set while `csp.hash` was `true`. These options cannot be used simultaneously.
 ```
 
+### invalid_id_prefix
+
+```
+The `idPrefix` option cannot include `--`.
+```
+
 ### lifecycle_function_unavailable
 
 ```

packages/svelte/messages/server-errors/errors.md

@@ -53,6 +53,10 @@ This error occurs when using `hydratable` multiple times with the same key. To a
 
 > `csp.nonce` was set while `csp.hash` was `true`. These options cannot be used simultaneously.
 
+## invalid_id_prefix
+
+> The `idPrefix` option cannot include `--`.
+
 ## lifecycle_function_unavailable
 
 > `%name%(...)` is not available on the server

packages/svelte/src/internal/server/errors.js

@@ -105,6 +105,18 @@ export function invalid_csp() {
 	throw error;
 }
 
+/**
+ * The `idPrefix` option cannot include `--`.
+ * @returns {never}
+ */
+export function invalid_id_prefix() {
+	const error = new Error(`invalid_id_prefix\nThe \`idPrefix\` option cannot include \`--\`.\nhttps://svelte.dev/e/invalid_id_prefix`);
+
+	error.name = 'Svelte error';
+
+	throw error;
+}
+
 /**
  * `%name%(...)` is not available on the server
  * @param {string} name

packages/svelte/src/internal/server/renderer.js

@@ -759,6 +759,10 @@ export class Renderer {
 	 * @returns {Renderer}
 	 */
 	static #open_render(mode, component, options) {
+		if (options.idPrefix?.includes('--')) {
+			e.invalid_id_prefix();
+		}
+
 		var previous_context = ssr_context;
 
 		try {