Convert numeric character references representing < and & into &lt; and &amp;

lib/sax.js

@@ -94,6 +94,10 @@
     }
   }
 
+  function unescapePredefined (str) {
+    return str.replace(/&lt;/g, '<').replace(/&amp;/g, '&')
+  }
+
   function checkBufferLength (parser) {
     var maxAllowed = Math.max(sax.MAX_BUFFER_LENGTH, 10)
     var maxActual = 0
@@ -644,10 +648,11 @@
       parser.attribList.push([parser.attribName, parser.attribValue])
     } else {
       // in non-xmlns mode, we can emit the event right away
-      parser.tag.attributes[parser.attribName] = parser.attribValue
+      const unescapedAttribValue = unescapePredefined(parser.attribValue)
+      parser.tag.attributes[parser.attribName] = unescapedAttribValue
       emitNode(parser, 'onattribute', {
         name: parser.attribName,
-        value: parser.attribValue
+        value: unescapedAttribValue
       })
     }
 
@@ -827,6 +832,14 @@
         num = parseInt(entity, 10)
         numStr = num.toString(10)
       }
+      switch (num) {
+        // Unescape these latter to avoid being treated now as starting
+        //   new items
+        case 60: // '<'
+          return '&lt;'
+        case 38: // '&'
+          return '&amp;'
+      }
     }
     entity = entity.replace(/^0+/, '')
     if (isNaN(num) || numStr.toLowerCase() !== entity) {