Do not escape comments

[Drup]

See #90
This is only a simplistic fix (and it adds re as a dep of the functor part, which is annoying).

[aantron]

In HTML (and IIRC XML), even -- is not allowed in comments, so it may be more sensible to replace -+ (as a regexp) with -. Also, the replacement > doesn't have any special meaning in comments.

[aantron]

Actually, in HTML5, <!--> is unfortunately a comment as well, so you need to avoid payloads beginning >. My commit comment is not sufficient to deal with this. Anyway, HTML is a giant mess and I need to take a break, but if you ignore this issue for a few hours, I will come back with some recommendation and a list of what things to watch out for, based on the comment parsing rules in the HTML spec.

[aantron]

Ok, here are all the cases for a comment ending "prematurely":

1. the comment data starts with >,
2. the comment data starts with ->,
3. the comment data contains '-->',
4. the comment data contains '--!>'.

Only (3) represents a valid comment terminator, but recovering parsers (such as in browsers) are required to end the comment in all of these situations.

(4) is a bit irregular: comment data can start with !> or -!> without triggering a premature comment end.

Probably, replacing > with > in each of these cases is the best approach. It applies systematically, and is pretty easy to reason about since > doesn't contain -, !, >.

[Drup]

@aantron Thanks a lot, I modified the code to handle all the cases.

[aantron]

👍 LGTM

[aantron]

I should qualify that – I looked at the comments. The XML declaration and DOCTYPE output code does look a bit sketchy, depending on where the arguments can come from.

[Drup]

The XML declaration and DOCTYPE output code does look a bit sketchy, depending on where the arguments can come from.

I doubt people will have user input ending up there.