From 6ebb0298efe1b2d419aa4eb9a86254fd5366b18f Mon Sep 17 00:00:00 2001
From: Anders Kaseorg <andersk@mit.edu>
Date: Sat, 3 Oct 2026 23:57:09 +0000
Subject: [PATCH 1/2] Don't escape raw text when serializing only an element's
 children

With include_self=False, serialize passed TraversalScope::ChildrenOnly
without the parent element's name.  html5ever's serializer uses that
name to decide whether the children are raw text, so the contents of
<script> and <style> were escaped: "if (a < b) {}" serialized as
"if (a &lt; b) {}", which changes the script.

Pass the element's name when serializing its children.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Anders Kaseorg <andersk@mit.edu>
---
 python/tests/test_dom.py | 11 +++++++++++
 src/parser.rs            | 11 ++++++++++-
 2 files changed, 21 insertions(+), 1 deletion(-)

diff --git a/python/tests/test_dom.py b/python/tests/test_dom.py
index 7220e41..dc8d2be 100644
--- a/python/tests/test_dom.py
+++ b/python/tests/test_dom.py
@@ -546,3 +546,14 @@ def test_attach_beside_orphan():
             orphan.create_element("b", ordering=ordering)
 
     assert dom.serialize(indent=0) == "<p>x</p>"
+
+
+def test_serializer_children_raw_text():
+    dom = markupever.parse(
+        "<script>if (a < b && c) {}</script><style>a > b { }</style><p>a < b</p>",
+        markupever.HtmlOptions(full_document=False),
+    )
+    script, style, p = dom.root().children()
+    assert script.serialize(indent=0, include_self=False) == "if (a < b && c) {}"
+    assert style.serialize(indent=0, include_self=False) == "a > b { }"
+    assert p.serialize(indent=0, include_self=False) == "a &lt; b"
diff --git a/src/parser.rs b/src/parser.rs
index f563b18..4f9c003 100644
--- a/src/parser.rs
+++ b/src/parser.rs
@@ -485,7 +485,16 @@ pub fn serialize(
     let traversal_scope = if include_self {
         ::treedom::markup5ever::serialize::TraversalScope::IncludeNode
     } else {
-        ::treedom::markup5ever::serialize::TraversalScope::ChildrenOnly(None)
+        // The serializer needs the parent's name to know whether its text
+        // children are raw text (as in <script> or <style>).
+        let name = dom
+            .get(node.id)
+            .unwrap()
+            .value()
+            .element()
+            .map(|element| element.name.clone());
+
+        ::treedom::markup5ever::serialize::TraversalScope::ChildrenOnly(name)
     };
 
     if !is_html {

From 7feed8b06081fdcbebc5413f8141ee8a97b5be48 Mon Sep 17 00:00:00 2001
From: Anders Kaseorg <andersk@mit.edu>
Date: Mon, 5 Oct 2026 11:05:42 +0000
Subject: [PATCH 2/2] Serialize a fragment as the contents of its context
 element

A fragment parsed with fragment_context is parsed as the contents of
the context element, but its nodes become the children of the tree's
document node, which serialize escapes as usual.  So text parsed in a
raw text context didn't round-trip:
parse('console.log("<br>")', HtmlOptions(fragment_context="script"))
serialized as 'console.log("&lt;br&gt;")', which parses back to
different text.

Remember the context element in IDTreeDOM, and serialize the document
node of a fragment as if its children were the children of the context
element, as html5ever's serializer allows.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Anders Kaseorg <andersk@mit.edu>
---
 docs/docs/parser.md         |  2 +-
 python/tests/test_parser.py | 29 +++++++++++++++++++++++++++++
 src/parser.rs               | 16 +++++++++-------
 treedom/src/dom.rs          | 10 ++++++++++
 treedom/src/parser.rs       | 17 ++++++++++++-----
 5 files changed, 61 insertions(+), 13 deletions(-)

diff --git a/docs/docs/parser.md b/docs/docs/parser.md
index d48a565..88e65ae 100644
--- a/docs/docs/parser.md
+++ b/docs/docs/parser.md
@@ -300,7 +300,7 @@ Let's see what parameters we have:
     # <p>A Text</p>
     ```
 
-* **`fragment_context`** - Parses a fragment as if it were the contents of this context element (like setting `innerHTML` on it). Pass a tag name such as `"td"`, or a `QualName` for an element in another namespace, such as `QualName("svg", "svg")`; a name without a namespace is an HTML element. Implies `full_document=False`. default: None (fragments are parsed in a `body` context).
+* **`fragment_context`** - Parses a fragment as if it were the contents of this context element (like setting `innerHTML` on it). Pass a tag name such as `"td"`, or a `QualName` for an element in another namespace, such as `QualName("svg", "svg")`; a name without a namespace is an HTML element. Implies `full_document=False`. The parsed tree is serialized as the contents of the context element, so that, for example, text parsed in a `script` context isn't escaped. default: None (fragments are parsed in a `body` context).
 
 === "\"tbody\""
 
diff --git a/python/tests/test_parser.py b/python/tests/test_parser.py
index 4672305..fe3d2d8 100644
--- a/python/tests/test_parser.py
+++ b/python/tests/test_parser.py
@@ -139,3 +139,32 @@ def test_meta_content_ending_in_charset():
             f'<meta http-equiv="Content-Type" content="{content}"><p>x</p>'
         )
         assert dom.select_one("p").text() == "x"
+
+
+def test_fragment_context_serialize():
+    # A fragment is serialized as the children of its context element, so that it round-trips.
+    src = 'console.log("<br>") &amp;'
+    for context, text, html in [
+        ("script", src, src),
+        ("style", src, src),
+        ("xmp", src, src),
+        ("plaintext", src, src),
+        ("textarea", 'console.log("<br>") &', 'console.log("&lt;br&gt;") &amp;'),
+        ("title", 'console.log("<br>") &', 'console.log("&lt;br&gt;") &amp;'),
+    ]:
+        options = markupever.HtmlOptions(fragment_context=context)
+        dom = markupever.parse(src, options)
+        assert dom.root().text() == text
+        assert dom.serialize() == html
+        assert dom.root().serialize(include_self=False) == html
+        assert markupever.parse(dom.serialize(), options).root().text() == text
+
+    # Text in other contexts is escaped.
+    dom = markupever.parse("a &lt; b", markupever.HtmlOptions(full_document=False))
+    assert dom.serialize() == "a &lt; b"
+
+    # Descendants of the fragment's nodes are serialized as usual.
+    dom = markupever.parse(
+        "<p>a &lt; b</p>", markupever.HtmlOptions(fragment_context="div")
+    )
+    assert dom.serialize() == "<p>a &lt; b</p>"
diff --git a/src/parser.rs b/src/parser.rs
index 4f9c003..f3f2cf7 100644
--- a/src/parser.rs
+++ b/src/parser.rs
@@ -482,17 +482,19 @@ pub fn serialize(
 
     let serializer = ::treedom::Serializer::new(&dom, node.id, indent);
 
-    let traversal_scope = if include_self {
+    let value = dom.get(node.id).unwrap().value();
+
+    let traversal_scope = if let Some(context) = value.document().and(dom.fragment_context()) {
+        // A fragment's nodes are the children of the document node, but were parsed as
+        // children of the context element, so serialize them as its children: for example,
+        // text parsed in a <script> context is raw text.
+        ::treedom::markup5ever::serialize::TraversalScope::ChildrenOnly(Some(context.clone()))
+    } else if include_self {
         ::treedom::markup5ever::serialize::TraversalScope::IncludeNode
     } else {
         // The serializer needs the parent's name to know whether its text
         // children are raw text (as in <script> or <style>).
-        let name = dom
-            .get(node.id)
-            .unwrap()
-            .value()
-            .element()
-            .map(|element| element.name.clone());
+        let name = value.element().map(|element| element.name.clone());
 
         ::treedom::markup5ever::serialize::TraversalScope::ChildrenOnly(name)
     };
diff --git a/treedom/src/dom.rs b/treedom/src/dom.rs
index fff86d1..f89798c 100644
--- a/treedom/src/dom.rs
+++ b/treedom/src/dom.rs
@@ -9,6 +9,7 @@ pub type NamespaceMap = HashMap<markup5ever::Prefix, markup5ever::Namespace>;
 pub struct IDTreeDOM {
     pub(super) tree: ego_tree::Tree<interface::Interface>,
     pub(super) namespaces: NamespaceMap,
+    pub(super) fragment_context: Option<markup5ever::QualName>,
 }
 
 impl IDTreeDOM {
@@ -19,6 +20,7 @@ impl IDTreeDOM {
         Self {
             tree: ego_tree::Tree::new(root.into()),
             namespaces,
+            fragment_context: None,
         }
     }
 
@@ -30,6 +32,7 @@ impl IDTreeDOM {
         Self {
             tree: ego_tree::Tree::with_capacity(root.into(), capacity),
             namespaces,
+            fragment_context: None,
         }
     }
 
@@ -40,6 +43,12 @@ impl IDTreeDOM {
     pub fn namespaces_mut(&mut self) -> &mut NamespaceMap {
         &mut self.namespaces
     }
+
+    /// Returns the context element that this DOM was parsed in, if it was parsed as a fragment.
+    /// Its root's children are the fragment's nodes.
+    pub fn fragment_context(&self) -> Option<&markup5ever::QualName> {
+        self.fragment_context.as_ref()
+    }
 }
 
 impl std::ops::Deref for IDTreeDOM {
@@ -70,6 +79,7 @@ impl std::fmt::Debug for IDTreeDOM {
             f.debug_struct("IDTreeDOM")
                 .field("tree", &self.tree)
                 .field("namespaces", &self.namespaces)
+                .field("fragment_context", &self.fragment_context)
                 .finish()?;
         }
 
diff --git a/treedom/src/parser.rs b/treedom/src/parser.rs
index 76a5848..7f61706 100644
--- a/treedom/src/parser.rs
+++ b/treedom/src/parser.rs
@@ -11,8 +11,9 @@ pub struct ParserSink {
     quirks_mode: Cell<markup5ever::interface::QuirksMode>,
     namespaces: RefCell<HashMap<markup5ever::Prefix, markup5ever::Namespace>>,
     lineno: Cell<u64>,
-    // Whether this sink is parsing a fragment, whose nodes html5ever puts in an <html> root element
-    fragment: bool,
+    // The context element if this sink is parsing a fragment, whose nodes html5ever puts in an
+    // <html> root element
+    fragment_context: Option<markup5ever::QualName>,
     // Attribute names of the elements passed to add_attrs_if_missing (only <html> and <body>),
     // so that repeated calls don't each scan the element's attributes
     attr_names: RefCell<HashMap<ego_tree::NodeId, HashSet<markup5ever::QualName>>>,
@@ -35,7 +36,7 @@ impl ParserSink {
             quirks_mode: Cell::new(markup5ever::interface::QuirksMode::NoQuirks),
             namespaces: RefCell::new(HashMap::new()),
             lineno: Cell::new(1),
-            fragment: false,
+            fragment_context: None,
             attr_names: RefCell::new(HashMap::new()),
         }
     }
@@ -62,7 +63,7 @@ impl ParserSink {
         let mut tree = self.tree.into_inner();
 
         // The fragment parsing algorithm returns the children of the <html> root element
-        if self.fragment {
+        if self.fragment_context.is_some() {
             if let Some(html) = tree.root().first_child().map(|x| x.id()) {
                 tree.root_mut().reparent_from_id_append(html);
                 tree.get_mut(html).unwrap().detach();
@@ -72,6 +73,7 @@ impl ParserSink {
         IDTreeDOM {
             tree,
             namespaces: self.namespaces.into_inner(),
+            fragment_context: self.fragment_context,
         }
     }
 
@@ -118,7 +120,7 @@ impl ParserSink {
             tree_builder,
         };
         let sink = Self {
-            fragment: true,
+            fragment_context: Some(context.clone()),
             ..Self::new()
         };
 
@@ -514,6 +516,11 @@ mod tests {
         assert_eq!(&*tr.value().element().unwrap().name.local, "tr");
         let td = tr.first_child().unwrap();
         assert_eq!(&*td.value().element().unwrap().name.local, "td");
+        // The DOM remembers the context
+        assert_eq!(
+            dom.fragment_context().map(|name| &*name.local),
+            Some("tbody")
+        );
 
         // In an svg context, elements are created in the SVG namespace
         let dom = parse_fragment(