HTML parser vulnerabilities

In childTextNodesAreLiteral, tree walking stopped at the nearest foreign ancestor once an HTML integration point was found. Because that integration point may itself be a descendant of a foster-parented element in a foreign namespace, a parser may resolve the subtree in a different namespace upon re-parsing rendered output. The fix continues walking the full ancestor chain and verifies every namespace transition occurs at an HTML integration point.

When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation reallocated and copied the accumulated string on every token. Inputs with many short text runs separated by ignored end tags caused O(n^2) allocations and byte copies. The fix accumulates coalesced text in per-node byte slices and materializes Data strings once at the end of parsing.

Parsing arbitrary HTML can consume excessive CPU time, leading to denial of service (DoS).