Merge "SECURITY: Escape > in Html::expandAttributes"