From 4603c05ab29651a89b45f8877eb10cc248345206 Mon Sep 17 00:00:00 2001 From: SGavrl <277843151+SGavrl@users.noreply.github.com> Date: Wed, 1 Jul 2026 15:58:49 +0000 Subject: [PATCH] fix(dom): neutralize "-->" when serializing comment contents The comment serializer wrote its contents verbatim. The HTML parser can never produce a comment whose data contains "-->" (it ends the comment), but script can via document.createComment("a-->b"). Serializing that verbatim closed the comment early and let the trailing text escape into markup. Replace "-->" with "-->" so the output round-trips as a single comment. Fixes #342. --- crates/obscura-dom/src/serialize.rs | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/crates/obscura-dom/src/serialize.rs b/crates/obscura-dom/src/serialize.rs index 7a489a5..608b5b4 100644 --- a/crates/obscura-dom/src/serialize.rs +++ b/crates/obscura-dom/src/serialize.rs @@ -72,7 +72,17 @@ impl DomTree { } NodeData::Comment { contents } => { buf.push_str("" (that ends the comment), but script can via + // document.createComment("a-->b"). Emitting it verbatim would close + // the comment early and let the trailing text escape into markup. + // Neutralize the terminator so the serialized output round-trips as + // a single comment. + if contents.contains("-->") { + buf.push_str(&contents.replace("-->", "-->")); + } else { + buf.push_str(contents); + } buf.push_str("-->"); } NodeData::ProcessingInstruction { target, data } => {