Small change to HTML with massive impact on eliminating mXSS attacks
GitHub
Escape "<" and ">" when serializing attribute values ยท whatwg/html@e21bd3b
Avoid a class of XSS attacks where markup goes through a lossy parse-serialize-parse roundtrip and the original attribute value is parsed in the da...