x/net/html: Namespace Confusion When Rendering Raw Text in Foreign Content

When rendering a parsed document, Go’s golang.org/x/net/html package decides whether the text children of an element are literal by walking its ancestors, but the walk stopped at the nearest foreign (SVG or MathML) ancestor once it found an HTML integration point. That integration point can itself sit under an element foster-parented into a foreign namespace, so re-parsing the rendered output resolves the subtree in a different namespace than the original. Applications that sanitize HTML and then render it can emit markup that browsers interpret differently.