feat(html): keep special chars in attrs as-is when possible

[sapphi-red]

Description

close #18811
refs #18067

[patak-cat]

this looks good to me to help projects move to Vite 6, we can still decide later on to revert and do a full escape in a future major.

[brokenmass]

I don't think '&' should be escaped.

• what if someone set an already escaped value like " test " . you will be converting that to the broken " test ", while in reality it was totaly valid attribute value.
• the only char to escape to prevent breaking the tag is the quotation character itself, in this case ", no ?

please do not manipulate user input, just ensure the value does not break out of the double quotes.

[sapphi-red]

• what if someone set an already escaped value like " test " . you will be converting that to the broken " test ", while in reality it was totaly valid attribute value.

If the user passed that value, Vite treats that that value should be the result interpreted by the browsers (or other HTML interpreters) rather than that value should be written in the HTML. If the plugin cares about the output content rather than the value interpreted, the plugin can still return a string in transformIndexHtml hook instead of returning an array. If you want the output to be " test ", you should pass " test ".

• the only char to escape to prevent breaking the tag is the quotation character itself, in this case ", no ?

That is true, but only escaping " makes the behavior inconsistent. Passing " will output a value that will be interpreted as ", but passing & will output a value that will be interpreted as &. It should be either:

• " -> ", & -> &: output as-is
• " -> ", & -> &: treat the input as the value interpret

[brokenmass]

I understand that but while it would be inconsistent if a user tried to do both approaches in the same project, it’s overall not inconsistent when you consider that 2 different users could use the 2 different ways “consistently” in their respective codebases.
User1 could only use escaped value while User2 only use unescaped once.

With this implementation you are disallowing User1 methodology altogether, and is my belief that it should not be a vite decision to enforce one way or the other.

[brokenmass]

any update ?