Comments are escaped and not checked #292

Recorded in the known issues: Comments are escaped and not checked

• Location: src/marshalling/marshal.ts, src/marshalling/marshalContext.ts (postProcessComments())
• Severity: High
• Effort: L
• Description: marshal() passes the comments among the child elements to fast-xml-builder as elements named #comment or #comment0, #comment1 and so on, and turns them into comments afterwards with a regular expression, because the builder's keyed-object mode can hold only one comment key per element. Their text is therefore escaped like element text: <!-- a & <b> --> is written back as <!-- a &amp; &lt;b&gt; -->, and a carriage return becomes 
. The comments before the root element are added to the output string without any check, so a comment that an application sets with -- or --> in it gives a document that is not well-formed or contains injected markup. The fix is to build the tree in the builder's ordered mode (preserveOrder: true), with comments, the XML declaration and the comments before the root as entries of their own, and to throw an error for a comment that contains -- or ends with -, because XML cannot represent it.