Skip to content

Hub: double-escaped HTML entities in React-rendered config strings (Starter Sites shows don't) #51

Description

@georgeolaru

Summary

Config strings that are escaped with esc_html__() and then rendered as text by the React hub show their HTML entities literally. The Starter Sites empty state renders:

Unfortunately, we don**'**t have any starter content to go with your theme right now.

(the apostrophe shows as the raw entity ').

Repro

Integrated-test site pixelgrade-integrated-check (http://localhost:8889) — Assistant + Plus active at main, Anima LT, unlicensed → Appearance → Pixelgrade → Starter Sites with no starter catalog.

Root cause

includes/default-plugin-config.php:449

'noSources' => esc_html__( 'Unfortunately, we don\'t have any starter content to go with your theme right now.', '__plugin_txtd' ),

esc_html__() encodes ''. The value is localized to JS and rendered as a React text node; React does not decode entities (and escapes again on render), so the entity is shown verbatim. Pre-escaping strings destined for React double-encodes them.

Fix

For strings that are localized and rendered as React text, use __() (not esc_html__()) — React handles escaping. Audit the localized config for other esc_html__() values that feed React text nodes (same pattern, only visible when the string contains ', &, <, >, quotes).

Severity

Minor / cosmetic.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Fields

    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions