TYPO3 Core

Problem still exists in v11. Not sure if we could safely remove this htmlspecialchars(). The recycler use getPageRecordTitle() which can be influenced via custom "label_userFunc". And there doesn't have to be htmlspecialchars. The security team should give feedback on this.

I don't know if there is a cleaner detection, maybe you could check on htmlspecialchars() and then handle it as the case may be.

Patch set 2 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/74065

Patch set 3 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/74065

Patch set 1 for branch 11.5 of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/74071