pfSense

I tried to rewrite the description from the GUI and it now displays correctly.

I made a backup to check how it's stored:

<descr><![CDATA[DNS sécurisé]]></descr>

No HTML entity, just the special character directly in the file. Which seems more correct since the description uses <![CDATA[]]>.

So I think the GUI expects the characters unescaped, but the upgrade and restore processes escapes all descriptions.

Jim Pingle wrote in #note-2:

What specific areas of the configuration were affected? Parts of the changes for #16661 specifically were to avoid double encoding.

By searching for double escaped HTML entities in my backups:

• Descriptions of static mapping on the DHCP server (IPv4)
• Descriptions of NAT rules
• Descriptions of firewall rules
• Texts of separators in firewall rules
• Descriptions of aliases
• Descriptions of individual items in aliases
• Descriptions of Wake-on-LAN entries
• Titles of picture widgets
• Descriptions of VLANs
• Descriptions of gateways
• Descriptions of gateway groups
• Descriptions of items in "pfBlockerNG > IP > IPv4"
• Descriptions of items in "pfBlockerNG > IP > IPv6"

This list is probably not exhaustive, I may not have used special characters everywhere or used every features of pfSense.

But there is a very clear pattern: It's everything that uses "<![CDATA[]]>" sections to store text.

To me it seems you manage special characters in the configuration with 2 different methods that conflicts with each other:

• Encapsulate text in "<![CDATA[]]>" so special characters becomes simple data
• Escape special characters as HTML entities

I suppose the solution is to commit to only one method:

• Either you remove the "<![CDATA[]]>" sections, so special characters are now replaced in the configuration for a good reason, and parsed correctly by the GUI
• Or you make sure that when texts are stored in the configuration, any text stored in "<![CDATA[]]>" sections is not escaped, or maybe unescaped before being stored, to ensure the text content doesn't get corrupted

Admittedly I'm a C# dev, not a PHP web developer so I may simply be wrong...

But I looked at changes for #16661, specifically commit:16d57928 and something looks wrong to me. :/ The following is done 2 times:

if (is_cdata_entity($ent)) {
    $xmlconfig .= "<{$ent}><![CDATA[" . htmlentities($val, ENT_QUOTES | ENT_SUBSTITUTE | ENT_XML1) . "]]></{$ent}>\n";
} else {
    $xmlconfig .= "<{$ent}>" . htmlentities($val, ENT_QUOTES | ENT_SUBSTITUTE | ENT_XML1) . "</{$ent}>\n";
}

Based on https://developer.mozilla.org/en-US/docs/Web/API/CDATASection -> In the first part of the IF you put the value in a "<![CDATA[]]>" section. So shouldn't you be only trying to escape the closing part instead of using "htmlentities"? Like replacing "]]>" with "]] >" or something like that?

Marcos M wrote in #note-5:

The following PHP code can be run at Diagnostics > Command Prompt which should fix the old values.

[...]

This code worked like a charm, my configuration file is clean again. Thanks!