[ataylor32]

I wonder how it handles cases like this:

<sc<script>ript>alert('XSS')</sc</script>ript>

...and other strings from https://github.com/minimaxir/big-list-of-naughty-strings

[open-paren]

  > (new Sanitizer()).sanitizeToString(`<sc<script>ript>alert('XSS')</sc</script>ript>`)
  "ript&gt;alert('XSS')ript&gt;"