Body-target app embed blocks injected before the first </body> substring (breaks when a theme has </body> in a comment)

Wanted to flag something I ran into while debugging a merchant store.

App embed blocks with target = "body" seem to be injected before the first occurrence of the literal string </body> in the rendered layout, rather than the actual document-closing tag.

If a theme has a </body> substring earlier in the page, for e.g. inside an HTML comment, all body-target app embeds get injected there instead.

In our case the merchant’s theme.liquid had:

<!-- note: this runs just before </body> -->

before the real </body>. Every body-target app embed (ours plus a couple of other apps) got injected before that </body>, which placed them inside the still-open comment. The comment’s --> then closed after the injected markup, so every embed was commented out and silently never ran.

Repro: add a comment containing the text </body> before the real closing tag in theme.liquid, enable any target: "body" app embed, then inspect the storefront DOM.

Worth noting the theme markup is valid HTML5, a </body> inside a comment is just opaque text per the spec, so it’s not obvious to merchants that their snippet is the trigger, and the failure is completely silent.

Easy enough to work around (rewrite the comment), just thought it was worth surfacing.

I believe this is a duplicate of:

https://community.shopify.dev/t/theme-app-extensions-injected-inside-html-comments-containing-body/

Although this is a duplicate I want to assure every Shopify staff that this is a pretty old bug, that I’ve remember noticing more than an year ago.

The other bug where the same behaviour happens if the store owner for some reason doesn’t close either the </body> or </html> tag is as old as Shopify.