From 49e2aa394be9a6a5bfcaf24ce258b9d8fb1c6509 Mon Sep 17 00:00:00 2001
From: Chase Fleming <1666730+chasefleming@users.noreply.github.com>
Date: Thu, 24 Jul 2025 18:00:40 -0700
Subject: [PATCH] Add additional comment escaping

---
 elements_test.go | 46 ++++++++++++++++++++++++++++++++++++++++++++++
 utils.go         |  3 +++
 2 files changed, 49 insertions(+)

diff --git a/elements_test.go b/elements_test.go
index c216cef..ea9cc2c 100644
--- a/elements_test.go
+++ b/elements_test.go
@@ -205,6 +205,52 @@ func TestCommentEscaping(t *testing.T) {
 	expected = `<!-- comment cannot end with this string &lt;!- -->`
 	actual = Comment("comment cannot end with this string <!-").Render()
 	assert.Equal(t, expected, actual)
+
+	// Test double dashes anywhere in comment
+	expected = `<!-- This comment has -&#45; double dashes -&#45; in it -->`
+	actual = Comment("This comment has -- double dashes -- in it").Render()
+	assert.Equal(t, expected, actual)
+
+	// Test null characters
+	expected = `<!-- This comment has &#0; null character -->`
+	actual = Comment("This comment has \x00 null character").Render()
+	assert.Equal(t, expected, actual)
+
+	// Test empty comment
+	expected = `<!--  -->`
+	actual = Comment("").Render()
+	assert.Equal(t, expected, actual)
+
+	// Test whitespace-only comment
+	expected = `<!--    -->`
+	actual = Comment("  ").Render()
+	assert.Equal(t, expected, actual)
+
+	// Test complex case with multiple escaping patterns
+	expected = `<!-- &lt;!-- -&#45; complex -&#45; case -&#45; with &#0; null --&gt; --!&gt; -->`
+	actual = Comment("<!-- -- complex -- case -- with \x00 null --> --!>").Render()
+	assert.Equal(t, expected, actual)
+
+	// Test edge cases that might be missing
+	// Comments that start with <! but not <!--
+	expected = `<!-- &lt;! test -->`
+	actual = Comment("<! test").Render()
+	assert.Equal(t, expected, actual)
+
+	// Comments that contain <! sequences
+	expected = `<!-- test &lt;! test -->`
+	actual = Comment("test <! test").Render()
+	assert.Equal(t, expected, actual)
+
+	// Comments that end with single dash
+	expected = `<!-- test - -->`
+	actual = Comment("test -").Render()
+	assert.Equal(t, expected, actual)
+
+	// Comments that start with single dash
+	expected = `<!-- - test -->`
+	actual = Comment("- test").Render()
+	assert.Equal(t, expected, actual)
 }
 
 // ========== Lists ==========
diff --git a/utils.go b/utils.go
index 9062066..97c22fb 100644
--- a/utils.go
+++ b/utils.go
@@ -16,6 +16,9 @@ var commentContentsReplacer = strings.NewReplacer(
 	"<!--", "&lt;!--",
 	"-->", "--&gt;",
 	"--!>", "--!&gt;",
+	"--", "-&#45;",
+	"\x00", "&#0;",
+	"<", "&lt;",
 )
 
 // If conditionally renders one of the provided elements based on the condition