Escape the source map URL before using it in a CSS comment

The URL must not be allowed to terminate the comment.

CHANGELOG.md

@@ -1,5 +1,9 @@
 ## 1.50.1
 
+* Fix a bug where a loud comment in the source can break the source map when
+  embedding the sources, when using the command-line interface or the legacy JS
+  API.
+
 ### Embedded Sass
 
 * The JS embedded host and the embedded compiler will now properly avoid

lib/src/executable/compile_stylesheet.dart

@@ -174,6 +174,8 @@ String _writeSourceMap(
     url = p.toUri(p.relative(sourceMapPath, from: p.dirname(destination)));
   }
 
+  var escapedUrl = url.toString().replaceAll("*/", "*\\/");
+
   return (options.style == OutputStyle.compressed ? '' : '\n\n') +
-      '/*# sourceMappingURL=$url */';
+      '/*# sourceMappingURL=$escapedUrl */';
 }

lib/src/node/legacy.dart

@@ -405,7 +405,8 @@ RenderResult _newRenderResult(
           : p.toUri(outFile == null
               ? sourceMapPath
               : p.relative(sourceMapPath, from: p.dirname(outFile)));
-      css += "\n\n/*# sourceMappingURL=$url */";
+      var escapedUrl = url.toString().replaceAll("*/", "*\\/");
+      css += "\n\n/*# sourceMappingURL=$escapedUrl */";
     }
   }
 

test/utils.dart

@@ -27,7 +27,7 @@ Map<String, dynamic> embeddedSourceMap(String css) {
   expect(css, matches(_sourceMapCommentRegExp));
 
   var match = _sourceMapCommentRegExp.firstMatch(css)!;
-  var data = Uri.parse(match[1]!).data!;
+  var data = Uri.parse(match[1]!.replaceAll("*\\/", "*/")).data!;
   expect(data.mimeType, equals("application/json"));
   return jsonDecode(data.contentAsString()) as Map<String, dynamic>;
 }