Allow using [] in the relaxed escaping as well

Author: mpdude

doc/filters/escape.rst

@@ -57,11 +57,11 @@ documents:
   also when used as the value of an HTML attribute **without quotes**
   (e.g. ``data-attribute={{ some_value }}``).
 
-* ``html_attr_relaxed``: like ``html_attr``, but **does not** escape ``@`` and ``:``
-  characters. You may want to use this in combination with front-end frameworks that
-  use attribute names like ``v-bind:href`` or ``@click``. But, be aware that in some
-  processing contexts like XML, characters like the colon ``:`` may have meaning like
-  for XML namespace separation.
+* ``html_attr_relaxed``: like ``html_attr``, but **does not** escape the ``@``, ``:``,
+  ``[`` and ``]`` characters. You may want to use this in combination with front-end
+  frameworks that use attribute names like ``v-bind:href`` or ``@click``. But, be
+  aware that in some processing contexts like XML, characters like the colon ``:``
+  may have meaning like for XML namespace separation.
 
 Note that doing contextual escaping in HTML documents is hard and choosing the
 right escaping strategy depends on a lot of factors. Please, read related

src/Runtime/EscaperRuntime.php

@@ -267,7 +267,7 @@ public function escape($string, string $strategy = 'html', ?string $charset = nu
 
                 $regex = match ($strategy) {
                     'html_attr' => '#[^a-zA-Z0-9,\.\-_]#Su',
-                    'html_attr_relaxed' => '#[^a-zA-Z0-9,\._:@]#Su',
+                    'html_attr_relaxed' => '#[^a-zA-Z0-9,\._:@\[\]]#Su',
                 };
 
                 $string = preg_replace_callback($regex, function ($matches) {

tests/Runtime/EscaperRuntimeTest.php

@@ -339,7 +339,7 @@ public function testHtmlAttributeEscapingEscapesOwaspRecommendedRanges()
 
     public function testHtmlAttributeRelaxedEscapingEscapesOwaspRecommendedRanges()
     {
-        $immune = [',', '.', '-', '_', ':', '@']; // Exceptions to escaping ranges
+        $immune = [',', '.', '-', '_', ':', '@', '[', ']']; // Exceptions to escaping ranges
         for ($chr = 0; $chr < 0xFF; ++$chr) {
             if ($chr >= 0x30 && $chr <= 0x39
             || $chr >= 0x41 && $chr <= 0x5A