HtmlSerializerRules.php

<?php

declare(strict_types = 1);

namespace Drupal\Component\Utility;

use Masterminds\HTML5\Serializer\OutputRules;

// cspell:ignore drupalhtmlbuilder

/**
 * Drupal-specific HTML5 serializer rules.
 *
 * Drupal's XSS filtering cannot handle entities inside element attribute
 * values. The XSS filtering was written based on W3C XML recommendations
 * which constituted that the ampersand character (&) and the angle
 * brackets (< and >) must not appear in their literal form in attribute
 * values. This differs from the HTML living standard which permits angle
 * brackets.
 *
 * @see core/modules/ckeditor5/js/ckeditor5_plugins/drupalHtmlEngine/src/drupalhtmlbuilder.js
 */
class HtmlSerializerRules extends OutputRules {

  /**
   * {@inheritdoc}
   */
  protected function escape($text, $attribute = FALSE) {
    $text = parent::escape($text, $attribute);

    if ($attribute) {
      $text = strtr($text, [
        '<' => '&lt;',
        '>' => '&gt;',
      ]);
    }

    return $text;
  }

}