From b6bb25e79ec041519a72066a7600d6b138ab22cd Mon Sep 17 00:00:00 2001
From: Will Anderson <will.anderson@neurontechnologies.ai>
Date: Mon, 11 May 2026 17:21:19 -0500
Subject: [PATCH] fix: heading and button elements pass children unescaped
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

el_h1/h2/h3/h4 and el_button were calling el_escape() on their
content, converting any HTML children (e.g. <span class="gold">)
into literal entity text on screen.

These functions accept composed HTML children, not raw text — they
should pass the argument through like el_div/el_p/el_span do.
el_text, el_attr, el_title, el_textarea, and el_img keep escaping
(they handle actual text/attribute values, not HTML children).
---
 dist/elhtml_impl.c | 40 ++++++++++++++++++++--------------------
 1 file changed, 20 insertions(+), 20 deletions(-)

diff --git a/dist/elhtml_impl.c b/dist/elhtml_impl.c
index a6ae454..f58dbfd 100644
--- a/dist/elhtml_impl.c
+++ b/dist/elhtml_impl.c
@@ -19,11 +19,11 @@ el_val_t el_li(el_val_t attrs, el_val_t children);
 el_val_t el_p(el_val_t attrs, el_val_t children);
 el_val_t el_span(el_val_t attrs, el_val_t children);
 el_val_t el_form(el_val_t attrs, el_val_t children);
-el_val_t el_h1(el_val_t attrs, el_val_t text);
-el_val_t el_h2(el_val_t attrs, el_val_t text);
-el_val_t el_h3(el_val_t attrs, el_val_t text);
-el_val_t el_h4(el_val_t attrs, el_val_t text);
-el_val_t el_button(el_val_t attrs, el_val_t label);
+el_val_t el_h1(el_val_t attrs, el_val_t children);
+el_val_t el_h2(el_val_t attrs, el_val_t children);
+el_val_t el_h3(el_val_t attrs, el_val_t children);
+el_val_t el_h4(el_val_t attrs, el_val_t children);
+el_val_t el_button(el_val_t attrs, el_val_t children);
 el_val_t el_a(el_val_t href, el_val_t attrs, el_val_t children);
 el_val_t el_input(el_val_t type_attr, el_val_t attrs);
 el_val_t el_textarea(el_val_t attrs, el_val_t value);
@@ -176,43 +176,43 @@ el_val_t el_form(el_val_t attrs, el_val_t children) {
   return 0;
 }
 
-el_val_t el_h1(el_val_t attrs, el_val_t text) {
+el_val_t el_h1(el_val_t attrs, el_val_t children) {
   if (str_eq(attrs, EL_STR(""))) {
-    return el_str_concat(el_str_concat(EL_STR("<h1>"), el_escape(text)), EL_STR("</h1>"));
+    return el_str_concat(el_str_concat(EL_STR("<h1>"), children), EL_STR("</h1>"));
   }
-  return el_str_concat(el_str_concat(el_str_concat(el_str_concat(EL_STR("<h1 "), attrs), EL_STR(">")), el_escape(text)), EL_STR("</h1>"));
+  return el_str_concat(el_str_concat(el_str_concat(el_str_concat(EL_STR("<h1 "), attrs), EL_STR(">")), children), EL_STR("</h1>"));
   return 0;
 }
 
-el_val_t el_h2(el_val_t attrs, el_val_t text) {
+el_val_t el_h2(el_val_t attrs, el_val_t children) {
   if (str_eq(attrs, EL_STR(""))) {
-    return el_str_concat(el_str_concat(EL_STR("<h2>"), el_escape(text)), EL_STR("</h2>"));
+    return el_str_concat(el_str_concat(EL_STR("<h2>"), children), EL_STR("</h2>"));
   }
-  return el_str_concat(el_str_concat(el_str_concat(el_str_concat(EL_STR("<h2 "), attrs), EL_STR(">")), el_escape(text)), EL_STR("</h2>"));
+  return el_str_concat(el_str_concat(el_str_concat(el_str_concat(EL_STR("<h2 "), attrs), EL_STR(">")), children), EL_STR("</h2>"));
   return 0;
 }
 
-el_val_t el_h3(el_val_t attrs, el_val_t text) {
+el_val_t el_h3(el_val_t attrs, el_val_t children) {
   if (str_eq(attrs, EL_STR(""))) {
-    return el_str_concat(el_str_concat(EL_STR("<h3>"), el_escape(text)), EL_STR("</h3>"));
+    return el_str_concat(el_str_concat(EL_STR("<h3>"), children), EL_STR("</h3>"));
   }
-  return el_str_concat(el_str_concat(el_str_concat(el_str_concat(EL_STR("<h3 "), attrs), EL_STR(">")), el_escape(text)), EL_STR("</h3>"));
+  return el_str_concat(el_str_concat(el_str_concat(el_str_concat(EL_STR("<h3 "), attrs), EL_STR(">")), children), EL_STR("</h3>"));
   return 0;
 }
 
-el_val_t el_h4(el_val_t attrs, el_val_t text) {
+el_val_t el_h4(el_val_t attrs, el_val_t children) {
   if (str_eq(attrs, EL_STR(""))) {
-    return el_str_concat(el_str_concat(EL_STR("<h4>"), el_escape(text)), EL_STR("</h4>"));
+    return el_str_concat(el_str_concat(EL_STR("<h4>"), children), EL_STR("</h4>"));
   }
-  return el_str_concat(el_str_concat(el_str_concat(el_str_concat(EL_STR("<h4 "), attrs), EL_STR(">")), el_escape(text)), EL_STR("</h4>"));
+  return el_str_concat(el_str_concat(el_str_concat(el_str_concat(EL_STR("<h4 "), attrs), EL_STR(">")), children), EL_STR("</h4>"));
   return 0;
 }
 
-el_val_t el_button(el_val_t attrs, el_val_t label) {
+el_val_t el_button(el_val_t attrs, el_val_t children) {
   if (str_eq(attrs, EL_STR(""))) {
-    return el_str_concat(el_str_concat(EL_STR("<button type=\"button\">"), el_escape(label)), EL_STR("</button>"));
+    return el_str_concat(el_str_concat(EL_STR("<button type=\"button\">"), children), EL_STR("</button>"));
   }
-  return el_str_concat(el_str_concat(el_str_concat(el_str_concat(EL_STR("<button type=\"button\" "), attrs), EL_STR(">")), el_escape(label)), EL_STR("</button>"));
+  return el_str_concat(el_str_concat(el_str_concat(el_str_concat(EL_STR("<button type=\"button\" "), attrs), EL_STR(">")), children), EL_STR("</button>"));
   return 0;
 }