#6362 Escape "<" and ">" when serializing attribute values

Avoid a class of XSS attacks where markup goes through
a lossy parse-serialize-parse roundtrip and the original
attribute value is parsed in the data state.

This reverts 4eeb8a1706c9545d5aedb5d569d7f55778da9782.

Fixes #6235.

• At least two implementers are interested (and none opposed):
  • Chromium: @mikewest @otherdaniel
  • Gecko: @mozfreddyb
  • WebKit
• Tests are written and can be reviewed and commented upon at:
  • https://github.com/web-platform-tests/wpt/pull/27501
• Implementation bugs are filed:
  • Chrome: https://bugs.chromium.org/p/chromium/issues/detail?id=1175016
  • Firefox: https://bugzilla.mozilla.org/show_bug.cgi?id=1941347
  • Safari: https://bugs.webkit.org/show_bug.cgi?id=292432

(See WHATWG Working Mode: Changes for more details.)

---

/parsing.html ( diff )

---

/parsing.html ( diff )