From dae1cb19a8ba8570eae791402693e123d56475fd Mon Sep 17 00:00:00 2001
From: John Oleksowicz <john.oleksowicz@automattic.com>
Date: Tue, 10 Oct 2023 10:22:30 -0500
Subject: [PATCH] Use `toString` instead of `html`

The content saved to the database already encodes content that needs
encoding, e.g. <script> tags. The problem with pQuery's `html` method is
 it decodes everything. By using toString instead, we should be getting
 the same contents that were saved to the database.

MAILPOET-5632
---
 .../lib/Newsletter/Renderer/Blocks/Text.php   |  6 ++--
 .../Newsletter/Renderer/Blocks/TextTest.php   | 35 +++++++++++++++++++
 2 files changed, 38 insertions(+), 3 deletions(-)

diff --git a/mailpoet/lib/Newsletter/Renderer/Blocks/Text.php b/mailpoet/lib/Newsletter/Renderer/Blocks/Text.php
index 2890b1ac5f..f0d7d964da 100644
--- a/mailpoet/lib/Newsletter/Renderer/Blocks/Text.php
+++ b/mailpoet/lib/Newsletter/Renderer/Blocks/Text.php
@@ -38,7 +38,7 @@ class Text {
         if (preg_match('/h\d/', $paragraph->getTag())) {
           $contents[] = $paragraph->getOuterText();
         } else {
-          $contents[] = str_replace('&', '&amp;', $paragraph->html());
+          $contents[] = $paragraph->toString(true, true, 1);
         }
           if ($index + 1 < $paragraphs->count()) $contents[] = '<br />';
           $paragraph->remove();
@@ -105,7 +105,7 @@ class Text {
       if (!preg_match('/text-align/i', $style)) {
         $style = 'text-align: left;' . $style;
       }
-      $contents = str_replace('&', '&amp;', $paragraph->html());
+      $contents = $paragraph->toString(true, true, 1);
       $paragraph->setTag('table');
       $paragraph->style = 'border-spacing:0;mso-table-lspace:0;mso-table-rspace:0;';
       $paragraph->width = '100%';
@@ -144,7 +144,7 @@ class Text {
     if (!$lists->count()) return $html;
     foreach ($lists as $list) {
       if ($list->tag === 'li') {
-        $list->setInnertext(str_replace('&', '&amp;', $list->html()));
+        $list->setInnertext($list->toString(true, true, 1));
         $list->class = 'mailpoet_paragraph';
       } else {
         $list->class = 'mailpoet_paragraph';
diff --git a/mailpoet/tests/unit/Newsletter/Renderer/Blocks/TextTest.php b/mailpoet/tests/unit/Newsletter/Renderer/Blocks/TextTest.php
index 98e0da3c2f..4527cdddeb 100644
--- a/mailpoet/tests/unit/Newsletter/Renderer/Blocks/TextTest.php
+++ b/mailpoet/tests/unit/Newsletter/Renderer/Blocks/TextTest.php
@@ -185,4 +185,39 @@ class TextTest extends \MailPoetUnitTest {
     $output = (new Text)->render($this->block);
     expect($output)->stringNotContainsString('<br />');
   }
+
+  public function htmlEntitiesStrings() {
+    return [
+      'paragraph' => ["<p>Text &lt;script&gt;alert('test');&lt;/script&gt;</p>"],
+      'list' => ["<ul>Text &lt;script&gt;alert('test');&lt;/script&gt;</li></ul>"],
+      'blockquote' => ["<ul>Text &lt;script&gt;alert('test');&lt;/script&gt;</li></ul>"],
+    ];
+  }
+
+  /**
+   * @dataProvider htmlEntitiesStrings
+   */
+  public function testItDoesNotDecodeHtmlEntities($htmlString) {
+    $this->block['text'] = $htmlString;
+    $output = (new Text())->render($this->block);
+    expect($output)->stringNotContainsString('<script>');
+    expect($output)->stringContainsString("&lt;script&gt;alert('test');&lt;/script&gt;");
+  }
+
+  public function childElementStrings(): array {
+    return [
+      'paragraph' => ['<p><a href="https://example.com">Link</a></p>'],
+      'list' => ['<p><ul><li><a href="https://example.com">Link</li></ul></a></p>'],
+      'blockquote' => ['<blockquote><p><a href="https://example.com">Link</a></p></blockquote>'],
+    ];
+  }
+
+  /**
+   * @dataProvider childElementStrings
+   */
+  public function testItMaintainsHtmlInChildElements($htmlString) {
+    $this->block['text'] = $htmlString;
+    $output = (new Text())->render($this->block);
+    expect($output)->stringContainsString('<a href="https://example.com">Link</a>');
+  }
 }