supported escaping for script element

[whisk]

Added support for script contents escaping according to the HTML5 standard: https://html.spec.whatwg.org/multipage/scripting.html#restrictions-for-contents-of-script-elements

Script with contents can be used like this:

Script(attrs.Props{}, Text("alert(1);"))

It required a workaround with the ScriptNode struct to maintain backward compatibility. While script tag may contain only a text node (formally any number of text nodes which are concatenated) the original Script() implementation allowed any number of arbitrary nodes or elements.

func Script(attrs attrs.Props, children ...Node) *Element {

[Copilot]

Pull Request Overview

Adds HTML5-compliant escaping for <script> element contents while preserving backward compatibility with existing Script(...) usage that accepted arbitrary child nodes.

• Introduces EscapeScriptContents with a strings.Replacer and wraps script children in a new ScriptNode to apply escaping.
• Updates Script(...) to transform children into ScriptNode instances.
• Adds tests for basic escaping scenarios.

Reviewed Changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

File	Description
utils.go	Adds script content escaping logic and public EscapeScriptContents function.
elem.go	Introduces ScriptNode to apply escaping when rendering script children.
elements.go	Wraps Script(...) children with ScriptNode to enforce escaping.
elements_test.go	Adds tests validating escaping behavior for specific substrings.

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

[Copilot]

Escaping is case-sensitive and will fail for sequences like </SCRIPT>, <SCRIPT, or <!-- with uppercase letters (end/script tags are ASCII case-insensitive in HTML); implement case-insensitive matching (e.g. a manual scan comparing lowercased substrings) to ensure all variants are escaped.

[whisk]

This is valid, fixed.

[Copilot]

Calling t.node.Render() allocates the full child content before escaping; for large script bodies a streaming approach (scan and write with replacements on the fly) would avoid an extra full-string allocation.

[whisk]

This is overengineering with little gain.