fix: encode special characters in HTMLElement textContent setter

src/nodes/html.ts

@@ -1,5 +1,5 @@
 import { is, selectAll, selectOne } from 'css-select';
-import { decodeHTML } from 'entities';
+import { decodeHTML, encode } from 'entities';
 import arr_back from '../back';
 import Matcher from '../matcher';
 import VoidTag from '../void-tag';
@@ -271,7 +271,7 @@ export default class HTMLElement extends Node {
 		return decode(this.rawText);
 	}
 	public set textContent(val: string) {
-		const content = [new TextNode(val, this)];
+		const content = [new TextNode(encode(val), this)];
 		this.childNodes = content;
 	}
 	/**

test/tests/textcontent-encode.js

@@ -0,0 +1,19 @@
+const { parse } = require('@test/test-target');
+
+describe('HTMLElement#textContent setter encodes special characters', function () {
+	it('escapes HTML metacharacters when serialized', function () {
+		const root = parse('<div></div>');
+		const div = root.firstChild;
+		div.textContent = '<b>Tom & Jerry</b>';
+		div.innerHTML.should.eql('&lt;b&gt;Tom &amp; Jerry&lt;/b&gt;');
+		div.textContent.should.eql('<b>Tom & Jerry</b>');
+	});
+	it('round-trips a text value that looks like markup', function () {
+		const root = parse('<div></div>');
+		const div = root.firstChild;
+		div.textContent = '<script>alert(1)</script>';
+		const reparsed = parse(div.toString()).firstChild;
+		reparsed.childNodes.should.have.length(1);
+		reparsed.textContent.should.eql('<script>alert(1)</script>');
+	});
+});