From 7c1b39338123a6c94f03664852134d70c396c8fb Mon Sep 17 00:00:00 2001
From: Yarchik <spoko.dev@gmail.com>
Date: Wed, 8 Jul 2026 17:59:21 +0100
Subject: [PATCH] fix: encode special characters in HTMLElement textContent
 setter

The HTMLElement textContent setter stored the raw string in a TextNode
without escaping, so setting textContent to a value containing '<', '>'
or '&' produced markup that was re-interpreted as HTML on serialization
and re-parsing (e.g. textContent = '<script>...' yielded a real <script>
child). The base Node textContent setter already encodes via entities;
this aligns HTMLElement with that behavior.
---
 src/nodes/html.ts                |  4 ++--
 test/tests/textcontent-encode.js | 19 +++++++++++++++++++
 2 files changed, 21 insertions(+), 2 deletions(-)
 create mode 100644 test/tests/textcontent-encode.js

diff --git a/src/nodes/html.ts b/src/nodes/html.ts
index f6f4ea7..d0b69d1 100644
--- a/src/nodes/html.ts
+++ b/src/nodes/html.ts
@@ -1,5 +1,5 @@
 import { is, selectAll, selectOne } from 'css-select';
-import { decodeHTML } from 'entities';
+import { decodeHTML, encode } from 'entities';
 import arr_back from '../back';
 import Matcher from '../matcher';
 import VoidTag from '../void-tag';
@@ -271,7 +271,7 @@ export default class HTMLElement extends Node {
 		return decode(this.rawText);
 	}
 	public set textContent(val: string) {
-		const content = [new TextNode(val, this)];
+		const content = [new TextNode(encode(val), this)];
 		this.childNodes = content;
 	}
 	/**
diff --git a/test/tests/textcontent-encode.js b/test/tests/textcontent-encode.js
new file mode 100644
index 0000000..b0106b3
--- /dev/null
+++ b/test/tests/textcontent-encode.js
@@ -0,0 +1,19 @@
+const { parse } = require('@test/test-target');
+
+describe('HTMLElement#textContent setter encodes special characters', function () {
+	it('escapes HTML metacharacters when serialized', function () {
+		const root = parse('<div></div>');
+		const div = root.firstChild;
+		div.textContent = '<b>Tom & Jerry</b>';
+		div.innerHTML.should.eql('&lt;b&gt;Tom &amp; Jerry&lt;/b&gt;');
+		div.textContent.should.eql('<b>Tom & Jerry</b>');
+	});
+	it('round-trips a text value that looks like markup', function () {
+		const root = parse('<div></div>');
+		const div = root.firstChild;
+		div.textContent = '<script>alert(1)</script>';
+		const reparsed = parse(div.toString()).firstChild;
+		reparsed.childNodes.should.have.length(1);
+		reparsed.textContent.should.eql('<script>alert(1)</script>');
+	});
+});