Document that filter_xss() must never be used in an attribute context

The first link is a 404 so I can't check if this has been resolved.

Anyone know if there is work to be done for this?

Unfortunately web.archive.org doesn't have that page indexed :sob:

I tried to rewrite the issue summary based on what I *think* that article said.

My copy is probably close to what needs to be added to the pages, so...needs review?

@greggles, thanks. Are you able to edit that page?

That is a page created from a documentation comment. Any change to that page requires changing a comment in Drupal core code.

I recall there was a page suggesting when Xss::filter() should be used. (Maybe that page still exists.)

IMO, that should be better written in the documentation for a Drupal core method, in the same way the documentation for FormattableMarkup::placeholderFormat() shows wrong calls to that method.

I fixed it on https://www.drupal.org/node/28984 →

@avpaderno I think documenting in multiple places is fine, so you could open another issue for the change you're proposing.