Fixed BC on XMLSanitizer

Author: Steveb-p

src/lib/RichText/XMLSanitizer.php

@@ -20,7 +20,6 @@ final class XMLSanitizer
 {
     public function sanitizeXMLString(string $xmlString): string
     {
-        $xmlString = $this->decodeHTMLEntities($xmlString);
         $xmlString = $this->removeComments($xmlString);
         $xmlString = $this->removeDangerousTags($xmlString);
         $xmlString = $this->sanitizeDocType($xmlString);
@@ -45,11 +44,6 @@ public function convertCDATAToText(DOMDocument $document): DOMDocument
         return $document;
     }
 
-    private function decodeHTMLEntities(string $xmlString): string
-    {
-        return html_entity_decode($xmlString, ENT_XML1, 'UTF-8');
-    }
-
     private function removeComments(string $xmlString): string
     {
         $xmlString = preg_replace('/<!--\s?.*?\s?-->/s', '', $xmlString);
@@ -124,6 +118,7 @@ private function filterEntitiesFromDocType(string $entitiesBlock): array
         $entityDefinitions = [];
 
         foreach ($lines as $line) {
+            $line = html_entity_decode($line, ENT_XML1, 'UTF-8');
             $line = trim($line);
 
             if (preg_match('/<!ENTITY\s+(\S+)\s+(SYSTEM|PUBLIC)\s+/i', $line, $matches)) {

src/lib/eZ/RichText/DOMDocumentFactory.php

@@ -42,7 +42,8 @@ public function loadXMLString(string $xmlString): DOMDocument
         // - substitute entities
         // - disable network access
         // - relax parser limits for document size/complexity
-        $success = $document->loadXML($this->xmlSanitizer->sanitizeXMLString($xmlString), LIBXML_NOENT | LIBXML_DTDLOAD | LIBXML_NONET | LIBXML_PARSEHUGE);
+        $xmlString = $this->xmlSanitizer->sanitizeXMLString($xmlString);
+        $success = $document->loadXML($xmlString, LIBXML_NOENT | LIBXML_DTDLOAD | LIBXML_NONET | LIBXML_PARSEHUGE);
         if (!$success) {
             throw new InvalidXmlException('$xmlString', libxml_get_errors());
         }

tests/lib/eZ/RichText/DOMDocumentFactoryTest.php

@@ -71,6 +71,20 @@ public function testEntityReferencesThrowsInvalidXmlException(): void
         $this->domDocumentFactory->loadXMLString($xml);
     }
 
+    public function testEncodedTagContentIsLeftAlone(): void
+    {
+        $xml = <<<EOT
+<?xml version="1.0"?>
+<para>By placing your order you agree to our <link>data &amp; privacy regulations</link>.</para>
+
+EOT;
+
+        $doc = $this->domDocumentFactory->loadXMLString($xml);
+        $docXMLString = $doc->saveXML();
+
+        self::assertSame($xml, $docXMLString);
+    }
+
     public function testRemoveEncodedEntities(): void
     {
         $xml = <<<EOT
@@ -114,7 +128,6 @@ public function testRemoveEncodedEntities(): void
      */
     public function testHandleDoctype(string $xml, string $stringNotContainsString): void
     {
-        $xml =
         $doc = $this->domDocumentFactory->loadXMLString($xml);
         $docXMLString = $doc->saveXML();
         self::assertIsString($docXMLString);