Hello,

     I don't really understand why an attribute with a null value is a threat from a security point of view. In your example, it seems indeed that the syntax is wrongly used, but I don't think it will create a security break : all you will probably get is an html code looking like '<img src="/download/..." yeah="" )="" alt="example.jpg">'.
This isn't clean from an HTML point of view, but it is from a security point of view :) 
It does not mean we shouldn't do something about that kind of things, but I don't think it's the right place or the right commit for it :). (But I must admit that isAttributeSafe would have been a better name for this method !).

Thanks !

Thomas