From 009376b274df2ebc50360cbedf29b2c6dcef7b2c Mon Sep 17 00:00:00 2001
From: Victor Solano <victor.solanonunez@gmail.com>
Date: Fri, 16 Oct 2026 19:06:39 +0200
Subject: [PATCH 1/2] fix: keep text elements' content out of attribute values
 (#341)

TextElement.toString() put the element text back at the first "><" of its
childless clone, which can be inside an attribute value, so a style,
script, title or textarea with such an attribute serialized its text into
the attribute and an empty element body.

The text now goes right before the end tag, the last "></" of the clone.
A clone that self-closes (in an XML document) is returned as before.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 cjs/html/text-element.js | 6 +++++-
 esm/html/text-element.js | 6 +++++-
 worker.js                | 6 +++++-
 3 files changed, 15 insertions(+), 3 deletions(-)

diff --git a/cjs/html/text-element.js b/cjs/html/text-element.js
index d55b5d3c..4040718f 100644
--- a/cjs/html/text-element.js
+++ b/cjs/html/text-element.js
@@ -10,7 +10,11 @@ class TextElement extends HTMLElement {
 
   toString() {
     const outerHTML = toString.call(this.cloneNode());
-    return outerHTML.replace('><', () => `>${this.textContent}<`);
+    // the text goes before the end tag: attribute values can contain "><" too
+    const end = outerHTML.lastIndexOf('></') + 1;
+    /* c8 ignore next */
+    if (!end) return outerHTML; // self-closed, as in XML documents
+    return outerHTML.slice(0, end) + this.textContent + outerHTML.slice(end);
   }
 }
 exports.TextElement = TextElement
diff --git a/esm/html/text-element.js b/esm/html/text-element.js
index ae231795..772198ed 100644
--- a/esm/html/text-element.js
+++ b/esm/html/text-element.js
@@ -9,6 +9,10 @@ export class TextElement extends HTMLElement {
 
   toString() {
     const outerHTML = toString.call(this.cloneNode());
-    return outerHTML.replace('><', () => `>${this.textContent}<`);
+    // the text goes before the end tag: attribute values can contain "><" too
+    const end = outerHTML.lastIndexOf('></') + 1;
+    /* c8 ignore next */
+    if (!end) return outerHTML; // self-closed, as in XML documents
+    return outerHTML.slice(0, end) + this.textContent + outerHTML.slice(end);
   }
 }
diff --git a/worker.js b/worker.js
index 2671c7f5..bd401d07 100644
--- a/worker.js
+++ b/worker.js
@@ -8482,7 +8482,11 @@ class TextElement extends HTMLElement {
 
   toString() {
     const outerHTML = toString.call(this.cloneNode());
-    return outerHTML.replace('><', () => `>${this.textContent}<`);
+    // the text goes before the end tag: attribute values can contain "><" too
+    const end = outerHTML.lastIndexOf('></') + 1;
+    /* c8 ignore next */
+    if (!end) return outerHTML; // self-closed, as in XML documents
+    return outerHTML.slice(0, end) + this.textContent + outerHTML.slice(end);
   }
 }
 

From 7048b6073407f5c5d37b8a994589a586704b1e86 Mon Sep 17 00:00:00 2001
From: Victor Solano <victor.solanonunez@gmail.com>
Date: Fri, 16 Oct 2026 19:16:05 +0200
Subject: [PATCH 2/2] fix: return a self-closed text element clone unchanged

Check for the self-closing form first, so an attribute value with "></"
in a text element imported into an XML document cannot take the text.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 cjs/html/text-element.js | 6 +++---
 esm/html/text-element.js | 6 +++---
 worker.js                | 6 +++---
 3 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/cjs/html/text-element.js b/cjs/html/text-element.js
index 4040718f..2dfe704c 100644
--- a/cjs/html/text-element.js
+++ b/cjs/html/text-element.js
@@ -10,10 +10,10 @@ class TextElement extends HTMLElement {
 
   toString() {
     const outerHTML = toString.call(this.cloneNode());
-    // the text goes before the end tag: attribute values can contain "><" too
-    const end = outerHTML.lastIndexOf('></') + 1;
     /* c8 ignore next */
-    if (!end) return outerHTML; // self-closed, as in XML documents
+    if (outerHTML.endsWith(' />')) return outerHTML; // self-closed, as in XML documents
+    // the text goes before the end tag, as attribute values can contain "></" too
+    const end = outerHTML.lastIndexOf('></') + 1;
     return outerHTML.slice(0, end) + this.textContent + outerHTML.slice(end);
   }
 }
diff --git a/esm/html/text-element.js b/esm/html/text-element.js
index 772198ed..1b64caa0 100644
--- a/esm/html/text-element.js
+++ b/esm/html/text-element.js
@@ -9,10 +9,10 @@ export class TextElement extends HTMLElement {
 
   toString() {
     const outerHTML = toString.call(this.cloneNode());
-    // the text goes before the end tag: attribute values can contain "><" too
-    const end = outerHTML.lastIndexOf('></') + 1;
     /* c8 ignore next */
-    if (!end) return outerHTML; // self-closed, as in XML documents
+    if (outerHTML.endsWith(' />')) return outerHTML; // self-closed, as in XML documents
+    // the text goes before the end tag, as attribute values can contain "></" too
+    const end = outerHTML.lastIndexOf('></') + 1;
     return outerHTML.slice(0, end) + this.textContent + outerHTML.slice(end);
   }
 }
diff --git a/worker.js b/worker.js
index bd401d07..84d093f2 100644
--- a/worker.js
+++ b/worker.js
@@ -8482,10 +8482,10 @@ class TextElement extends HTMLElement {
 
   toString() {
     const outerHTML = toString.call(this.cloneNode());
-    // the text goes before the end tag: attribute values can contain "><" too
-    const end = outerHTML.lastIndexOf('></') + 1;
     /* c8 ignore next */
-    if (!end) return outerHTML; // self-closed, as in XML documents
+    if (outerHTML.endsWith(' />')) return outerHTML; // self-closed, as in XML documents
+    // the text goes before the end tag, as attribute values can contain "></" too
+    const end = outerHTML.lastIndexOf('></') + 1;
     return outerHTML.slice(0, end) + this.textContent + outerHTML.slice(end);
   }
 }