TYPO3 Core

It's coming from this and the following functions as I see it.
https://github.com/TYPO3/TYPO3.CMS/blob/master/typo3/sysext/scheduler/Classes/Task/ExecuteSchedulableCommandAdditionalFieldProvider.php#L335

/**
     * Get a human-readable label for a command argument
     *
     * @param InputArgument $argument
     * @return string
     */
    protected function getArgumentLabel(InputArgument $argument): string
    {
        return 'Argument: ' . $argument->getName() . '. <em>' . htmlspecialchars($argument->getDescription()) . '</em>';
    }

    /**
     * Get a human-readable label for a command option
     *
     * @param InputOption $option
     * @return string
     */
    protected function getOptionLabel(InputOption $option): string
    {
        return 'Option: ' . htmlspecialchars($option->getName()) . '. <em>' . htmlspecialchars($option->getDescription()) . '</em>';
    }

I have tried to use the format viewhelper in the EditTask.html to have it parsed correct. But no success.

This is a "regression" from:

https://review.typo3.org/c/Packages/TYPO3.CMS/+/66663
https://github.com/TYPO3/TYPO3.CMS/commit/6a972407b5d025322901d89d9f0318d69f2c29c8

The Security fix is of course more important, so not sure if regression is the right word, it's at least introduced as a consequence of this update.

I don't think they are only related, I think there are the "same" issue.

Seems to be a general problem.

I can confirm this bug.

It comes from a double encoding in the "typo3/sysext/fluid/Classes/ViewHelpers/Be/Labels/CshViewHelper.php":

// Double encode can be set to true, once the typo3fluid/fluid fix is released and required
$label = '<label>' . htmlspecialchars($label, ENT_QUOTES, null, false) . '</label>';

Eric

Still open. #92964 was fixed.

I am not able to reproduce it on version 13 (latest main)

Moreover the lines reported on comment 1 are not present anymore if I am not wrong

About comment 7, am I totally wrong or CSH has been removed on version 12? https://docs.typo3.org/c/typo3/cms-core/main/en-us/Changelog/12.0/Breaking-97312-RemoveContextSensitiveHelp.html