HTML attributes on elements that a tag helper targets are double-encoded

[dougbu]

1. start with MVC tag helper sample
2. add some-test="<>&lt;" to an element that no tag helper targets e.g. <optgroup/>
3. add some-test="<>&lt;" to an element that a tag helper targets e.g. <option/>
4. Ctrl-F5
5. go to page you changed
6. view source
7. observe the <optgroup/> element includes the expected some-test="<>&lt;" attribute
8. observe the <option/> element instead includes some-test="<><"

[dougbu]

<link href='some-href' /> and <script src='some-source'/> are triple-encoded because those attributes are HTML-encoded again when they are copied from one TagHelperOutput to another. hard to see unless you use a complicated (OData?) URL.

discussed a bit already. a few ideas:

• stop HTML encoding values in the TagHelperOutput.Attributes collection when generating start tags and stop HTML encoding attribute values when copying from one TagHelperOutput to another
  • must change current behaviour of some MVC tag helpers and confirm correct operation
  • could lead to problems where an attribute value a negligent tag helper adds is never encoded
• change the TagHelperOutput.Attributes collection to be IDictionary<string, object> and stick HtmlString instances in there when the value is already encoded
  • a fair amount of plumbing we might need to pull out when work on TagHelperOutput doesn't allow multiple non-bound TagHelper attributes with identical names. #279 comes in
• track the source of attribute values in TagHelperOutput and only HTML encode those values when a tag helper sets them directly
  • would need an escape hatch so that tag helpers can safely copy from one TagHelperOutput to another
• speed up TagHelperOutput doesn't allow multiple non-bound TagHelper attributes with identical names. #279
  • bit hard to do quickly because that's a big change at design PR stage

[dougbu]

33407ef and aspnet/Mvc@5882cdb