Problem/Motivation
The class Attribute is used in drupal to collect and render html attributes. It applies 'htmlspecialchars'(inside check_plain) to everything. It appears the assumption is that any html element attribute will be displayed on the page. This has not been a problem in the past but it destroys any html entities whose values start with &, such as 'numeric character reference (NCR', which are commonly used with the data-* attribute.
This has stopped #1836160: Support icon fonts in menu links. A patch was ready to be published but is non-functional because of this issue. It might also have some impact on aria-* attributes, which are already seeing expanded use in drupal. A screening mechanism is needed. The class Attribute seems to be the logical place to place it.