FIX HTMLEditorField is not able to show html or xml code examples

[sabina-talipova]

Description

Additional condition to avoid double ampersand encoding.

Parent issue

• HTMLEditorField is not able to show html/xml code examples #11207

[emteknetnz]

Suggested change

	if ($matches[0] != '&') {
	return str_replace($matches[0], htmlentities($matches[0], ENT_COMPAT, 'UTF-8', true), $matches[0]);
	} else {
	return str_replace($matches[0], htmlentities($matches[0], ENT_COMPAT, 'UTF-8', false), $matches[0]);
	}
	$doubleEncode = $matches[0] !== '&'
	return htmlentities($matches[0], ENT_COMPAT, 'UTF-8', $doubleEncode);

[emteknetnz]

Why is this changing?

Wouldn't .RAW allow XSS to be added to the caption field and then executed by whoever looks at it?

[sabina-talipova]

What happens if the caption contains an &?

Sorry, I haven't replied. I added this to avoid double encoding for & in caption in Embed short codes.
We convert all characters to HTML entities before save data in DB.

Wouldn't .RAW allow XSS to be added to the caption field and then executed by whoever looks a

I'm not sure 100%, but I check another fields where we use RAW method and I also did few XSS tests with string contains javascript.

Just in case, return this back to encode string again: https://github.com/silverstripe/silverstripe-framework/pull/11243/files#diff-d0d2867af6bff9ad7e4ced04d5491feea4b4efec408b6e96b37e4f5eb46914ecR174-R175.
It's not necessary, probably.

[emteknetnz]

Tested locally, seems to work correctly