Escape HTML: Always Escape Ampersand

packages/block-library/src/code/utils.js

@@ -11,7 +11,6 @@ import { flow } from 'lodash';
  */
 export function escape( content ) {
 	return flow(
-		escapeAmpersands,
 		escapeOpeningSquareBrackets,
 		escapeProtocolInIsolatedUrls
 	)( content || '' );
@@ -27,33 +26,9 @@ export function unescape( content ) {
 	return flow(
 		unescapeProtocolInIsolatedUrls,
 		unescapeOpeningSquareBrackets,
-		unescapeAmpersands
 	)( content || '' );
 }
 
-/**
- * Returns the given content with all its ampersand characters converted
- * into their HTML entity counterpart (i.e. & => &)
- *
- * @param {string}  content The content of a code block.
- * @return {string} The given content with its ampersands converted into
- *                  their HTML entity counterpart (i.e. & => &)
- */
-function escapeAmpersands( content ) {
-	return content.replace( /&/g, '&' );
-}
-
-/**
- * Returns the given content with all & HTML entities converted into &.
- *
- * @param {string}  content The content of a code block.
- * @return {string} The given content with all & HTML entities
- *                  converted into &.
- */
-function unescapeAmpersands( content ) {
-	return content.replace( /&/g, '&' );
-}
-
 /**
  * Returns the given content with all opening shortcode characters converted
  * into their HTML entity counterpart (i.e. [ => [). For instance, a

packages/element/src/test/serialize.js

@@ -188,7 +188,7 @@ describe( 'renderElement()', () => {
 	it( 'renders escaped string element', () => {
 		const result = renderElement( 'hello & world &amp; friends <img/>' );
 
-		expect( result ).toBe( 'hello &amp; world &amp; friends &lt;img/>' );
+		expect( result ).toBe( 'hello &amp; world &amp;amp; friends &lt;img/>' );
 	} );
 
 	it( 'renders numeric element as string', () => {

packages/escape-html/src/index.js

@@ -31,7 +31,7 @@ const REGEXP_INVALID_ATTRIBUTE_NAME = /[\u007F-\u009F "'>/="\uFDD0-\uFDEF]/;
  * @return {string} Escaped string.
  */
 export function escapeAmpersand( value ) {
-	return value.replace( /&(?!([a-z0-9]+|#[0-9]+|#x[a-f0-9]+);)/gi, '&' );
+	return value.replace( /&/gi, '&' );
 }
 
 /**

packages/escape-html/src/test/index.js

@@ -22,7 +22,7 @@ function testEscapeAmpersand( implementation ) {
 	it( 'should escape ampersand', () => {
 		const result = implementation( 'foo & bar & & baz Σ &#bad; Σ Σ &#xevil;' );
 
-		expect( result ).toBe( 'foo & bar & & baz Σ &#bad; Σ Σ &#xevil;' );
+		expect( result ).toBe( 'foo & bar & & baz Σ &#bad; Σ Σ &#xevil;' );
 	} );
 }