Merge pull request from GHSA-gw32-9rmw-qwww

* rename previous test

* add new <textarea bind:value> test

* escape value in <textarea bind:value>

---------

Co-authored-by: Conduitry <git@chor.date>

src/compiler/compile/render_ssr/handlers/Element.ts

@@ -149,7 +149,7 @@ export default function (node: Element, renderer: Renderer, options: RenderOptio
 			// value = name === 'textContent' ? x`@escape($$value)` : x`$$value`;
 		} else if (binding.name === 'value' && node.name === 'textarea') {
 			const snippet = expression.node;
-			node_contents = x`${snippet} || ""`;
+			node_contents = x`@escape(${snippet} || "")`;
 		} else if (binding.name === 'value' && node.name === 'select') {
 			// NOTE: do not add "value" attribute on <select />
 		} else {

test/runtime/samples/textarea-bind-value-escape/main.svelte

@@ -0,0 +1,5 @@
+<script>
+	let value = `test'"></textarea><script>alert('BIM');</` + `script>`;
+</script>
+
+<textarea bind:value />

test/runtime/samples/textarea-value-escape/_config.js

@@ -0,0 +1,4 @@
+export default {
+	html: '<textarea></textarea>',
+	ssrHtml: '<textarea>test\'"&gt;&lt;/textarea&gt;&lt;script&gt;alert(\'BIM\');&lt;/script&gt;</textarea>'
+};