[Bug] HTML pipeline replaces '$' sequence with </html> in injected scripts

[zdfb]

[Bug] HTML pipeline replaces '$' sequence with </html> in injected scripts

First of all, thanks for the great work on DSH — it's a really well-designed plugin system. I came across a small issue while building a plugin and wanted to report it in case it's helpful.

Symptom

The browser console shows:

(index):33 Uncaught SyntaxError: Invalid or unexpected token

The offending line is inside a plugin-injected <script> tag:

function fmtC(n){if(!n)return'$0.0000';return'
</html>
+Number(n).toFixed(4)}

The original source was:

function fmtC(n){if(!n)return'$0.0000';return'$'+Number(n).toFixed(4)}

What I think is happening

The injected HTML goes through some server-side HTML processing before being served. During that processing, the sequence '$' (single-quote + dollar + single-quote) gets replaced with \n</html>\n, which breaks the JavaScript inside the <script> tag.

I verified this by comparing the source string vs. the served response: the source has 2 $ characters and 0 </html> occurrences; the served output has 1 $ and 1 </html>.

Reproduction

Any plugin that injects a <script> block containing a '$' sequence via ctx.webServer.tapIndex() triggers this. For example, a script line like:

return '$' + value;

gets served as:

return '
</html>
+ value;

Workaround I used

I changed the script to avoid the '$' sequence (e.g. using double quotes or String.fromCharCode(36)), which works around it. But I'm not sure if this affects other legit plugin scripts, so I wanted to flag it here.

If this is a known limitation or if I'm missing something about how tapIndex/HTML processing works, please let me know — happy to adjust my approach. Thanks for reading!

[denial123789]

I reproduced the exact transformation, but the source boundary points to a narrower cause than the Harness pipeline itself.

In rc.7, WebServer.applyIndexTaps() only calls each registered transform in order and assigns its return value. It has no dollar-sign replacement logic. The failure occurs when a plugin callback uses a dynamic string as the second argument to String.replace, for example:

html.replace('</html>', `${script}</html>`)

JavaScript replacement strings have their own token grammar. The sequence $' means “insert the input suffix after the match.” Therefore a payload containing:

return '$' + value

creates $' inside the replacement string. Node reproduces the reported result: the dollar and quote disappear and the suffix after the closing tag is inserted into the script.

The robust fix is to return the dynamic content from a callback:

html.replace('</html>', () => `${script}</html>`)

or use lastIndexOf plus explicit slicing, which is also the shape used by the official boot-manifest injector. Changing only this currency string to double quotes or String.fromCharCode(36) masks one trigger but leaves the transform unsafe for other replacement tokens such as $& and captures.

I documented the reproduction, diagnostic boundary, safe insertion forms, and regression matrix here: https://sandbaseai.github.io/deepseek-harness-handbook/tapindex-dollar-corruption.html

Independent community handbook, not an official DeepSeek AI project.