Toast and escape characters in utf8

[lekoala]

Module version(s) affected

2.1.5

Description

This is related to silverstripe/silverstripe-framework#11089

Currently, toast messages are escaped using Convert::raw2xml. This means that characters like ' are escaped to their utf8 equivalent (eg: X-Status: Saved Viewing "test event's ...)
But the js itself doesn't do anything to display this properly

See here the status message handler

silverstripe-admin/client/src/legacy/LeftAndMain.js

Lines 1511 to 1514 in ef1385a

	var statusMessage = function(text, type) {
	text = jQuery('<div/>').text(text).html(); // Escape HTML entities in text
	jQuery.noticeAdd({text: text, type: type, stayTime: 5000, inEffect: {left: '0', opacity: 'show'}});
	};

On top of that, the method used to escape the characters (that should already be safe, but still) is not optimal (see https://stackoverflow.com/questions/1147359/how-to-decode-html-entities-using-jquery/) since adding this in a div could still execute malicious code. Ideally, that should be a standard way to escape strings across the framework without having custom bits of code like this.

How to reproduce

• Go to model admin to a record with a ' in the name
• Click save
• Discover the utf8 encoded ' that is not displayed properly in the toast message

Possible Solution

No response

Additional Context

No response

Validations

• Check that there isn't already an issue that reports the same bug
• Double check that your reproduction steps work in a fresh installation of silverstripe/installer (with any code examples you've provided)

PRs

• add missing rawurlencode silverstripe-framework#11105
• decode entities in toast message #1640
• properly encode X-Status silverstripe-versioned#438
• Properly use X-Status silverstripe-versioned#440

[lekoala]

WIP

Using this works for the single quote

function decodeEntities(encodedString) {
  var textArea = document.createElement('textarea');
  textArea.innerHTML = encodedString;
  return textArea.value;
}

but doesn't help with ö so there is more to it that it seems

[lekoala]

Two pr to fix this

silverstripe/silverstripe-framework#11105
#1640

[GuySartorelli]

This is mostly fixed now - but & is still being escaped to &

[GuySartorelli]

All PRs now merged. Anything that hasn't yet been tagged will be automagically tagged by GitHub Actions.