WP 5.5 Block Directory special characters are displayed as HTML entity codes during block search

[thomasplevy]

Describe the bug

When a plugin in the block directory which has special characters in it's name is rendered in the block directory (sidebar), the special characters are displayed as plain-text entity codes instead of the actual character.

For example, an ampersand & will be displayed as &

To reproduce

Steps to reproduce the behavior:

On WP 5.5

1. Navigate to a post or page with the block editor enabled
2. Click on the "add block" plus sign at the top of the page
3. Search for my block "Lite LMS Progress Tracker"
4. See the special characters in the sidebar after search results load (see screenshot below)

Expected behavior

Special characters should not be displayed as text. For example, I expect to see & in favor of &

Screenshots

Editor version (please complete the following information):

• WordPress version: 5.5
• Does the website has Gutenberg plugin installed, or is it using the block editor that comes by default? default
• If the Gutenberg plugin is installed, which version is it? N/A

Desktop (please complete the following information):

• OS: Ubuntu 20.04.01
• Browser: Brave
• Version: Version 1.8.96 Chromium: 81.0.4044.138 (Official Build) (64-bit)

Smartphone (please complete the following information):
N/A

Additional context

I found this issue with my own block plugin that I added to the directory yesterday. I've since changed the title of my plugin to exclude the special characters. Currently my reproduction steps are still working with the old title (that contained an endash and an ampersand) but this may change whenever the cached title is nuked.

Without this plugin I'm not entirely sure how to recreate this but I'm hoping the problem can be recreated through a mock of some kind.

[TimothyBJacobs]

AFAIK this is because Gutenberg isn't using <RawHtml> component to display the title, even though it is valid for the title to have HTML. WordPress Core applies wp_kses to the title before rendering it.

So I think to fix this we need to change the block directory code to use <RawHTML> and at the same time update the REST API to apply that kses information: https://github.com/WordPress/wordpress-develop/blob/f0733600c9b8a0833d7e63f60fae651d46f22320/src/wp-admin/includes/class-wp-plugin-install-list-table.php#L442

[ryelle]

This should be fixed in Gutenberg 8.8, so I think it'll be fixed in the next point release of WordPress. See the fix: #24172.

That PR used a different approach, just decoding entities before rendering, since block titles aren't expected to contain HTML.

[thomasplevy]

thanks @ryelle !