Specify htmlspecialchars() flags

The default flags change from ENT_COMPAT to ENT_QUOTES | ENT_SUBSTITUTE
| ENT_HTML401 in PHP 8.1; to avoid the output changing between versions,
let’s explicitly use the following flags:

- ENT_QUOTES, encoding both kinds of quotes (not just "), just in case
- ENT_SUBSTITUTE, substitute invalid code unit sequences instead of
  returning an empty string
- ENT_HTML5 (i.e. ' instead of '), because MediaWiki output
  has been HTML5 for many years now

Bug: T319219
Change-Id: I0f26467b7b0eb9518fc5612987dcc5fed8681cbb

Author: lucaswerkmeister

lib/includes/Formatters/WikibaseValueFormatterBuilders.php

@@ -211,7 +211,9 @@ private function isHtmlFormat( $format ) {
 	private function escapeValueFormatter( $format, ValueFormatter $formatter ) {
 		switch ( $this->snakFormat->getBaseFormat( $format ) ) {
 			case SnakFormatter::FORMAT_HTML:
-				return new EscapingValueFormatter( $formatter, 'htmlspecialchars' );
+				return new EscapingValueFormatter( $formatter, static function ( string $string ): string {
+					return htmlspecialchars( $string, ENT_QUOTES | ENT_SUBSTITUTE | ENT_HTML5 );
+				} );
 			case SnakFormatter::FORMAT_WIKI:
 				return new EscapingValueFormatter( $formatter, 'wfEscapeWikiText' );
 			default:

lib/tests/phpunit/Formatters/WikibaseValueFormatterBuildersTest.php

@@ -451,14 +451,14 @@ public function provideNewFormatter() {
 				SnakFormatter::FORMAT_HTML_VERBOSE,
 				$this->newFormatterOptions( 'de' ),
 				new GlobeCoordinateValue( new LatLongValue( -55.755786, 37.25633 ), 0.25 ),
-				'@^<div><kartographer-html/><div class="wikibase-kartographer-caption">55°45\'S, 37°15\'E</div></div>$@'
+				'@^<div><kartographer-html/><div class="wikibase-kartographer-caption">55°45&apos;S, 37°15&apos;E</div></div>$@'
 			],
 			'coordinate kartographer preview html' => [
 				'GlobeCoordinate',
 				SnakFormatter::FORMAT_HTML_VERBOSE_PREVIEW,
 				$this->newFormatterOptions( 'de' ),
 				new GlobeCoordinateValue( new LatLongValue( -55.755786, 37.25633 ), 0.25 ),
-				'@^<div><kartographer-preview-html/><div class="wikibase-kartographer-caption">55°45\'S, 37°15\'E</div></div>$@'
+				'@^<div><kartographer-preview-html/><div class="wikibase-kartographer-caption">55°45&apos;S, 37°15&apos;E</div></div>$@'
 			],
 
 			// Quantity