Unescape innerHTML artifacts with workers

Author: WebReflection

docs/core.js

@@ -1,4 +1,5 @@
 import dedent from 'codedent';
+import { unescape } from 'html-escaper';
 
 const { isArray } = Array;
 
@@ -36,7 +37,7 @@ const dispatch = (target, type, worker = false, CE = CustomEvent) => {
 /* c8 ignore stop */
 
 export {
-    dedent,
+    dedent, unescape,
     dispatch,
     isArray,
     assign,

docs/core.js.map

@@ -1,6 +1,6 @@
 import { INVALID_CONTENT, INVALID_SRC_ATTR, INVALID_WORKER_ATTR } from '../errors.js';
 
-import { dedent } from '../utils.js';
+import { dedent, unescape } from '../utils.js';
 
 const hasCommentsOnly = text => !text
     .replace(/\/\*[\s\S]*?\*\//g, '')
@@ -25,11 +25,11 @@ export default element => {
           else {
               const { innerHTML, localName, type } = element;
               const name = type || localName.replace(/-script$/, '');
+              value = unescape(innerHTML);
               console.warn(
                   `Deprecated: use <script type="${name}"> for an always safe content parsing:\n`,
-                  innerHTML,
+                  value,
               );
-              value = innerHTML;
           }
 
           const url = URL.createObjectURL(new Blob([dedent(value)], { type: 'text/plain' }));

esm/utils.js

@@ -67,7 +67,8 @@
         "@ungap/with-resolvers": "^0.1.0",
         "basic-devtools": "^0.1.6",
         "codedent": "^0.1.2",
-        "coincident": "^0.13.3"
+        "coincident": "^0.13.3",
+        "html-escaper": "^3.0.3"
     },
     "worker": {
         "blob": "sha256-wpW1JDUswE7n7bkoJJYLv66C9OuoZbVItbc+oW3ttD8="