While looking at the patch for T97157, I realised that language converter can be tricked in even more ways, by adding conversion rule delimiters.
*sigh*
Basically, -{}- breaks up the string it runs the regex on, so if you insert it in an attribute, then language converter no longer realizes its in the middle of a bunch of html.
Some examples:
```
-{H|abc=>sr-el:" onfocus="alert(1)" onload="alert(2)" data-foo="}-
{{special:Contributions|target=-{}-abc-{}-}}
[[File:"8th Anniversary Celebration" - NARA - 285576.tif|100px|alt=-{n}-abc-{}-]]
```
(This assumes your language code is set to 'sr', you are viewing the sr-el variant, and you have an image on your wiki with that name).
Interestingly, Sanitizer::safeEncodeAttribute already escapes all the neccesary stuff. So ordinary tags aren't affected.
See also T118755
Patches
-----
* Master (As of July 26, 2016): {F4307597}, {F4307604}
* REL1_27: {F4307600}, {F4307605}
* REL1_26: {F4307601}, {F4307606}
* REL1_23: {4307602}, {F4307607}