Follow up of this conversation: #684 (comment)

This is best explained by a simple example:

<script type="text/javascript">
console.log("js: a &amp; b");
</script>
<py-script>
import js
js.console.log("py: a &amp; b");
</py-script>

This produces the following:

js: a & b
py: a & b

This is even worse if we use " or ', because currently they are interpreted as quotes and thus they can easily trigger Python syntax errors; e.g. the following trigger a SyntaxError:

<py-script>
import js
js.console.log("py: a &quot; b");
</py-script>

By reading the code, it seems that the interpretation of HTML entities happens here:

I don't really understand what's going on: inside htmlDecode input seems to be the raw string of text that we want; then we put it inside DOMParser(), only to extract the text back.
PR #684 mitigates the issue by escaping angle brackets, but why do we need to call DOMParser in the first place?

/cc @philippjfr who worked on this recently and @fpliger who might remember what was the original idea