Make html-escape also escape < and > in attributes.

sdk/lib/convert/html_escape.dart

 // Copyright (c) 2013, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 part of dart.convert;
 
 /**
  * A `String` converter that converts characters to HTML entities.
  *
  * This is intended to sanitice text before inserting the text into an HTML
@@ skipping 20 matching lines @@
  *
  * Allows specifying a mode for HTML escaping that depend on the context
  * where the escaped result is going to be used.
  * The relevant contexts are:
  *
  * * as text content of an HTML element.
  * * as value of a (single- or double-) quoted attribute value.
  *
  * All modes require escaping of `&` (ampersand) characters, and may
  * enable escaping of more characters.
+ *
+ * Custom escape modes can be created using the [HtmlEscapeMode.HtmlEscapeMode]
+ * constructor.
  */
 class HtmlEscapeMode {
   final String _name;
   /** Whether to escape '<' and '>'. */
   final bool escapeLtGt;
   /** Whether to escape '"' (quote). */
   final bool escapeQuot;
   /** Whether to escape "'" (apostrophe). */
   final bool escapeApos;
   /**
@@ skipping 16 matching lines @@
    */
   static const HtmlEscapeMode UNKNOWN =
       const HtmlEscapeMode._('unknown', true, true, true, true);
 
   /**
    * Escaping mode for text going into double-quoted HTML attribute values.
    *
    * The result should not be used as the content of an unquoted
    * or single-quoted attribute value.
    *
-   * Escapes only double quotes (`"`) but not single quotes (`'`).
+   * Escapes double quotes (`"`) but not single quotes (`'`),
+   * and escapes `<` and `>` characters because they are not allowed
+   * in strict XHTML attributes
    */
   static const HtmlEscapeMode ATTRIBUTE =
-      const HtmlEscapeMode._('attribute', false, true, false, false);
+      const HtmlEscapeMode._('attribute', true, true, false, false);
 
   /**
    * Escaping mode for text going into single-quoted HTML attribute values.
    *
    * The result should not be used as the content of an unquoted
    * or double-quoted attribute value.
    *
-   * Escapes only single quotes (`'`) but not double quotes (`"`).
+   * Escapes single quotes (`'`) but not double quotes (`"`),
+   * and escapes `<` and `>` characters because they are not allowed
+   * in strict XHTML attributes
    */
   static const HtmlEscapeMode SQ_ATTRIBUTE =
-      const HtmlEscapeMode._('attribute', false, false, true, false);
+      const HtmlEscapeMode._('attribute', true, false, true, false);
 
   /**
    * Escaping mode for text going into HTML element content.
    *
    * The escaping only works for elements with normal HTML content,
    * and not for, for example, script or style element content,
    * which require escapes matching their particular content syntax.
    *
    * Escapes `<` and `>` characters.
    */
@@ skipping 113 matching lines @@
     if(val == null) {
       _sink.addSlice(chunk, start, end, isLast);
     } else {
       _sink.add(val);
       if (isLast) _sink.close();
     }
   }
 
   void close() => _sink.close();
 }