--- a/vendor/golang.org/x/net/html/token.go	Tue Aug 23 22:33:28 2022 +0200
+++ b/vendor/golang.org/x/net/html/token.go	Tue Aug 23 22:39:43 2022 +0200
@@ -110,9 +110,9 @@
 	case SelfClosingTagToken:
 		return "<" + t.tagString() + "/>"
 	case CommentToken:
-		return "<!--" + t.Data + "-->"
+		return "<!--" + EscapeString(t.Data) + "-->"
 	case DoctypeToken:
-		return "<!DOCTYPE " + t.Data + ">"
+		return "<!DOCTYPE " + EscapeString(t.Data) + ">"
 	}
 	return "Invalid(" + strconv.Itoa(int(t.Type)) + ")"
 }