Upstream patch proposed:

https://www.redhat.com/archives/libvir-list/2015-May/msg00110.html

Upstream commit:

commit d091518b353d49b772a1e68acbe0fd0be76e33d6
Author: Pavel Hrdina <phrdina>
Date:   Tue May 5 16:52:46 2015 +0200

    XML: escape strings where we should do it
    
    There is a lot of places, were it's pretty easy for user to enter some
    characters that we need to escape to create a valid XML description.
    
    Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1197580
    
    Signed-off-by: Pavel Hrdina <phrdina>

v1.2.15-63-gd091518

Steps:
1.Define a vm with the attributes as below:
...
    <graphics type='vnc' port='-1' autoport='yes' socket='&lt;&gt;'>
    </graphics>
...

2.Dump the xml:
# virsh dumpxml test
...
    <graphics type='vnc' socket='<>'/>
...

3.Try to edit the xml:
# virsh edit test
error: (domain_definition):125: Unescaped '<' not allowed in attributes values
    <graphics type='vnc' socket='<>'/>
---------------------------------^
Failed. Try again? [y,n,i,f,?]: 


The issue still exists with graphics->socket.

Hi, you're right, I've missed that one.

(In reply to Pavel Hrdina from comment #5)
> Hi, you're right, I've missed that one.

Hello, Pavel

Will you include the fix in this bug? Or we can just verify it with the current fix now, and note the missing part in the comment.

Hi, there is a patch upstream, that fixes it, but it's not critical and we will not include it in RHEL-7.2.  Please create a new bug against RHEL-7.3 so we can track this issue.

Thanks

Test on build libvirt-1.2.17-13.el7.x86_64:

Domain xml:
1)Define a guest with the following settings:
# cat escape.xml
<domain type='kvm'>
  <name>test4&lt;</name>
  <title>A short description -&lt;&gt; title - of the domain</title>
--
  <cpu mode='custom' match='exact'>
      <model vendor_id='uthedjdjdj&lt;&gt;'>IvyBridge&lt;&gt;</model>
      <vendor>Intel&lt;&gt;</vendor>
  </cpu>
--
  <devices>
    <emulator>/usr/libexec/dd&lt;/qemu-kvm</emulator>
--
    <interface type='network'>
      <rom bar='on' file='/etc/fake/boot&lt;&gt;.bin'/>
--
    <serial type="udp">
      <source mode="bind" host="&lt;ddd0.0.0.0&gt;" service="&lt;2445&gt;"/>
      <source mode="connect" host="&lt;ddd0.0.0.0&gt;" service="&lt;2445&gt;"/>
--
    <serial type="tcp">
      <source mode="bind" host="&lt;ddd0.0.0.0&gt;" service="&lt;2445&gt;"/>
--
    <serial type="tcp">
      <source mode="connect" host="&lt;ddd0.0.0.0&gt;" service="&lt;2445&gt;"/>
--
    <serial type="nmdm">
      <source master="/dev/n&lt;mdm0&gt;A" slave="/dev/nm&lt;dm0&gt;B"/>
--
  </devices>
  <seclabel type='dynamic' model='selinux&lt;&gt;' relabel='yes'/>

# virsh define escape.xml 
Domain test4< defined from escape.xml

2)Dumpxml, the special characters are escaped correctly:
# virsh dumpxml 'test4<'
  <name>test4&lt;</name>
  <title>A short description -&lt;&gt; title - of the domain</title>
    <model fallback='allow' vendor_id='uthedjdjdj&lt;&gt;'>IvyBridge&lt;&gt;</model>
    <vendor>Intel&lt;&gt;</vendor>
    <emulator>/usr/libexec/dd&lt;/qemu-kvm</emulator>
      <rom bar='on' file='/etc/fake/boot&lt;&gt;.bin'/>
      <source mode='bind' host='&lt;ddd0.0.0.0&gt;' service='&lt;2445&gt;'/>
      <source mode='connect' host='&lt;ddd0.0.0.0&gt;' service='&lt;2445&gt;'/>
      <source mode='bind' host='&lt;ddd0.0.0.0&gt;' service='&lt;2445&gt;'/>
      <source mode='connect' host='&lt;ddd0.0.0.0&gt;' service='&lt;2445&gt;'/>
      <source master='/dev/n&lt;mdm0&gt;A' slave='/dev/nm&lt;dm0&gt;B'/>
  <seclabel type='dynamic' model='selinux&lt;&gt;' relabel='yes'/>

3)Try to edit the guest xml, edit succeed:
# virsh edit 'test4<'
Domain test4< XML configuration edited.

4)Define a guest xml with the following settings:
# cat escape.xml |grep spiceport -a3
    <serial type="spiceport">
      <source channel="org.qemu.console.s&lt;erial.0"/>

# virsh define escape.xml 
error: Failed to define domain from escape.xml
error: invalid argument: Invalid character in source channel for char device



Network xml:
1)Define a network with the following settings:
# cat vepa-network.xml
<network>
  <dns>
    <txt name="example&quot;" value="example value&quot;" />
    <srv service='name' protocol='tcp' domain='test-domain-name&quot;' target='.&quot;' port='1024' priority='10' weight='10'/>
    <host ip='192.168.122.2'>
      <hostname>myh&quot;ost</hostname>
      <hostname>myh&quot;ostalias</hostname>

# virsh net-define vepa-network.xml 
Network vepa-net defined from vepa-network.xml

2)Dumpxml,  the special characters are escaped correctly:
# virsh net-dumpxml vepa-net
...
    <txt name='example&quot;' value='example value&quot;'/>
    <srv service='name' protocol='tcp' domain='test-domain-name&quot;' target='.&quot;' port='1024' priority='10' weight='10'/>
      <hostname>myh&quot;ost</hostname>
      <hostname>myh&quot;ostalias</hostname>
...

3)Try to edit the network xml, edit succeed:
# virsh net-edit vepa-net
Network vepa-net XML configuration edited.

(In reply to Pavel Hrdina from comment #7)
> Hi, there is a patch upstream, that fixes it, but it's not critical and we
> will not include it in RHEL-7.2.  Please create a new bug against RHEL-7.3
> so we can track this issue.
> 
> Thanks

Comment 8 tested part of the places that have been escaped correctly.

Move this bug to verified. And created new bug 1270427 for the missing two places that need to escape:
/domain/devices/disk/driver[@name]
/domain/devices/graphics[@socket]

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2015-2202.html