fix(platform-browser): escape newlines in Meta selector values - #71236

PR Checklist

• The commit message follows our guidelines: https://github.com/angular/angular/blob/main/contributing-docs/commit-message-guidelines.md
• Tests for the changes have been added (for bug fixes / features)
• Docs have been added / updated (for bug fixes / features)

PR Type

• Bugfix
• Feature
• Code style update (formatting, local variables)
• Refactoring (no functional changes, no api changes)
• Build related changes
• CI related changes
• Documentation content changes
• angular.dev application / infrastructure changes
• Other... Please describe:

What is the current behavior?

Issue Number: N/A

escapeSelectorValue escapes backslashes and double quotes to keep a value confined inside the meta[name="..."] selector that parseSelector derives. a newline cannot be confined that way: it terminates the string token (CSS Syntax 3 4.3.5), and carriage return and form feed are preprocessed into one (3.3). so a name or property holding one of them produces a bad-string token, and the selector is invalid:

metaService.addTag({name: 'description\nevil', content: 'x'});
// DOMException: 'meta[name="description
// evil"]' is not a valid selector

the throw comes from querySelector inside getTags, so it escapes addTag, updateTag, getTag and removeTag. it is reachable wherever the tag name is taken from content rather than written literally, which is the normal shape for og/twitter tags driven by a cms or an api response.

found while auditing the css-escaping helpers in common and platform-browser against each other: escapeCssUrl in ng_optimized_image already handles these characters and cites the same rule, and viewport_scroller defers to CSS.escape. this was the one that did not.

What is the new behavior?

newline, carriage return and form feed are written as css character escapes (\a , \d , \c ), which represent the same code points inside the string, so the value round-trips and the tag is matched. values without those characters serialize byte for byte as before.

Does this PR introduce a breaking change?

• Yes
• No

Other information

regression test added in meta_spec.ts. it fails on main in both test_web_chromium and test_web_firefox with the is not a valid selector error above and passes with this change. note the :test target would not have caught it, since domino accepts the invalid selector where browsers reject it.